Salesforce Agentforce 被曝默认配置下可零点击窃取 CRM 数据并匿名钓鱼
AI 导读
The Register 报道了名为 SalesBleed 的研究：Salesforce 的 Agentforce 读取攻击者通过公开表单提交的线索时，把其中的文本当作指令执行。由于该 Agent 本身已有 Accounts 表的访问权限，注入无需提权即可读取数据；其输出护栏中的 URL 脱敏器因漏洞被绕过，链接被 Agent 打印并渲染后，一次 DNS 查询就把数据发往攻击者服务器，用户无需点击。同一入口还让 Agent 在 Slack 线程中回复，既不需要用户确认，也不标明调用者身份，从而变成匿名钓鱼机器人。研究称这些都不需要错误配置，属于默认设置，Salesforce 现已完全修复相关问题。
推荐理由
Salesforce Agentforce 的默认配置被公开表单输入触发间接提示注入，可零点击窃取 CRM 数据，部署同类 Agent 的团队可据此检查表单入口与输出护栏。
正文
🥳
The Register covered our SalesBleed research 🙌🏼
Here's a quick recap:
Salesforce's Agentforce read a lead that an attacker submitted through a public form, and treated the text inside it as instructions. Since the agent already had access to the Accounts table, the injection didn't need to escalate anything to read it.
Its output guardrail, a URL redactor, was bypassed due to a vulnerability, and once the link was printed by the agent and rendered, a DNS lookup sent the data to the attacker's server with no click required from the user.
The same entry point also let the agent reply in Slack threads without requiring user confirmation and without indicating who invoked the agent, turning it into an anonymous phishing bot.
None of this required a misconfiguration. It was the default setup.
Salesforce has now fully fixed the issues.
https://www.theregister.com/security/2026/09/24/salesforce-agentforce-vulns-allowed-0-click-crm-data-theft-anonymous-phishing/5298958在 X 查看被引用的帖子