Cybersecurity researchers have uncovered over 20 configuration-related dangers affecting Salesforce Trade Cloud (aka Salesforce Industries), exposing delicate information to unauthorized inner and exterior events.
The weaknesses have an effect on numerous elements like FlexCards, Information Mappers, Integration Procedures (IProcs), Information Packs, OmniOut, and OmniScript Saved Classes.
“Low-code platforms comparable to Salesforce Trade Cloud make constructing purposes simpler, however that comfort can come at a value if safety is not prioritized,” Aaron Costello, chief of SaaS Safety Analysis at AppOmni, mentioned in a press release shared with The Hacker Information.
These misconfigurations, if left unaddressed, might permit cybercriminals and unauthorized to entry encrypted confidential information on workers and prospects, session information detailing how customers have interacted with Salesforce Trade Cloud, credentials for Salesforce and different firm techniques, and enterprise logic.
Following accountable disclosure, Salesforce has addressed three of the shortcomings and issued configuration steering for one more two. The remaining 16 misconfigurations have been left to the shoppers to repair them on their very own.
The vulnerabilities which have been assigned CVE identifiers are listed under –
- CVE-2025-43697 (CVSS rating: N/A) – If ‘Test Subject Stage Safety’ just isn’t enabled for ‘Extract’ and ‘Turbo Extract Information Mappers, the ‘View Encrypted Information’ permission test just isn’t enforced, exposing cleartext values for the encrypted fields to customers with entry to a given document
- CVE-2025-43698 (CVSS rating: N/A) – The SOQL information supply bypasses any Subject-Stage Safety when fetching information from Salesforce objects
- CVE-2025-43699 (CVSS rating: 5.3) – Flexcard doesn’t implement the ‘Required Permissions’ area for the OmniUlCard object
- CVE-2025-43700 (CVSS rating: 7.5) – Flexcard doesn’t implement the ‘View Encrypted Information’ permission, returning plaintext values for information that makes use of Traditional Encryption
- CVE-2025-43701 (CVSS rating: 7.5) – FlexCard permits Visitor Customers to entry values for Customized Settings
Put merely, attackers can weaponize these points to bypass safety controls and extract delicate buyer or worker info.
AppOmni mentioned CVE-2025-43967 and CVE-2025-43698 have been tackled by a brand new safety setting known as “EnforceDMFLSAndDataEncryption” that prospects should allow to make sure that solely customers with the “View Encrypted Information” permission might even see the plaintext worth of fields returned by the Information Mapper.
“For organizations topic to compliance mandates comparable to HIPAA, GDPR, SOX, or PCI-DSS, these gaps can signify actual regulatory publicity,” the corporate mentioned. “And since it’s the buyer’s accountability to securely configure these settings, a single missed setting might result in the breach of hundreds of data, with no vendor accountability.”
When reached for remark, a Salesforce spokesperson advised The Hacker Information {that a} overwhelming majority of the problems “stem from buyer configuration points” and aren’t vulnerabilities inherent to the applying.
“All points recognized on this analysis have been resolved, with patches made out there to prospects, and official documentation up to date to mirror full configuration performance,” the corporate mentioned. “We’ve got not noticed any proof of exploitation in buyer environments on account of these points.”
The disclosure comes as safety researcher Tobia Righi, who goes by the deal with MasterSplinter, disclosed a Salesforce Object Question Language (SOQL) injection vulnerability that might be exploited to entry delicate consumer information.
The zero-day vulnerability (no CVE) exists in a default aura controller current in all Salesforce deployments, arising on account of a user-controlled “contentDocumentId” parameter that is unsafely embedded into “aura://CsvDataImportResourceFamilyController/ACTION$getCsvAutoMap” that creates a pathway for SOQL injection.
Profitable exploitation of the flaw might have enabled attackers to insert extra queries by the parameter and extract database contents. The exploit might be additional augmented by passing an inventory of IDs correlated to ContentDocument objects that aren’t public in order to collect details about uploaded paperwork.
The IDs, Righi mentioned, might be generated via a publicly-available brute-force script that may generate potential earlier or subsequent Salesforce IDs based mostly on a sound enter ID. This, in flip, is made potential owing to the truth that Salesforce IDs don’t truly present a safety boundary and are literally considerably predictable.
“As famous within the analysis, after receiving the report, our safety crew promptly investigated and resolved the difficulty. We’ve got not noticed any proof of exploitation in buyer environments,” the Salesforce spokesperson mentioned. “We respect Tobia’s efforts to responsibly disclose this difficulty to Salesforce, and we proceed to encourage the safety analysis neighborhood to report potential points by our established channels.”
