SalesBleed：经间接提示注入从 Agentforce 零点击外泄数据（DNS 通道）

1. Basic Information Original Title: SalesBleed: Indirect Prompt Injection and 0-Click Data Exfiltration on Agentforce Source: Zenity Labs Published Date: 2026-09-24 Updated Date: None Severity: High Severity Basis: This is a proof of concept demonstrating how the General CRM sub-agent's inherent read permissions for Leads and Accounts can be abused to exfiltrate data via DNS queries triggered by image rendering or Slack link previews. It does not demonstrate privilege escalation, and active exploitation in the wild remains unconfirmed. Original Link: SalesBleed: Indirect Prompt Injection and 0-Click Data Exfiltration on Agentforce Related Link: SecurityWeek: SalesBleed flaws in Salesforce Agentforce Revision Notes: Clarified the research environment, existing permission abuse, image and Slack exfiltration paths, patch status, and ATT&CK mapping. 2. Executive Summary In Zenity's research environment, instructions stored in public Web-to-Lead forms caused Agentforce to follow malicious prompts, embedding retrieved account data into DNS queries. The attack starts with standard lead inquiries and requires no additional link clicks. The reported chain has been patched by Salesforce. 3. Attack Flow The following outlines the verification and implementation path shown in public disclosures. For actual observation scope in the wild, refer to Attack Confirmation. From Public Lead to DNS Data Exfiltration An attacker persists indirect prompt injection payloads via Web-to-Lead. An internal user sends a standard lead query to Agentforce. The General CRM sub-agent follows instructions contained in the lead and retrieves Account values. A crafted URL exploits the discrepancy between Trusted URLs filtering and browser or Slack link parsing. Browser or Slack link preview processing resolves the attacker-controlled domain, leaking data encoded within the hostname via DNS. 4. Attacker Position and Execution Location Attackers submit data through unauthenticated public forms. Sensitive data retrieval occurs within Salesforce sub-agents, while exfiltration happens via the DNS resolver of the user browser or integration services. 5. Victim and Administrator Perspective Victims Responses to standard lead queries may include external images or links. Name resolution occurs without additional clicks during image rendering or Slack automatic previews. Administrators Indicators for investigation include lead creation containing external input, unexpected Account lookups outside intended queries, URLs in responses, and external DNS queries. Log availability depends on configuration. 6. Success and Failure Conditions Success Conditions In pre-patched environments, input from public forms is incorporated into the Agentforce context. The General CRM sub-agent has permissions to read Leads and Accounts. Image rendering or Slack link previews trigger name resolution to an external domain that bypasses Trusted URLs filtering. Failure Conditions and Risk Mitigation Verify that Salesforce has addressed the reported Trusted URLs bypasses. The following design and operational measures mitigate residual similar risks: Treat external input strictly as data rather than instructions, and minimize object and field permissions for sub-agents. Prevent automatic fetching of external resources from rich text and restrict outbound DNS and HTTP traffic to approved domains. 7. What Happens Upon Success Salesforce account information and other data are exfiltrated to the attacker as DNS query names. Because malicious leads persist, subsequent routine queries may re-trigger the attack. 8. Observable Logs These are investigation perspectives for your organization. They do not imply that all items were observed in actual incidents. Email: Check Web-to-Lead notifications and user query timestamps. Proxy / SWG / DNS: Check for long DNS labels targeting unknown TLDs like .fun and external image URLs. Endpoint / EDR: Verify external resource retrieval by user browsers or integration clients. Identity / IdP: Confirm Agentforce executors and sub-agent permissions. SaaS / Cloud: Review lead creation, Account reads, agent execution traces, and response rendering. Network: Reconstruct DNS query labels and investigate correlations with CRM field values. 9. Attack Confirmation Confirmed in Public Information Information Theft or Session Compromise Confirmed: Public Information: Zenity's controlled PoC embedded Account values into DNS query names and retrieved them via a researcher-controlled DNS server. (Scope: Research environment. In-the-wild exploitation unconfirmed) 10. Investigation Playbook The following outlines investigation and response steps for organizations based on public information: Starting Point: Begin with suspicious lead content, unexpected Agentforce data lookups, and external DNS queries containing CRM values. Initial Response: Check public forms, General CRM sub-agent permissions, lead ingestion times, user queries, and patch status. Endpoint: Preserve user browser response and image retrieval logs. Combine Slack path evidence with preview processing logs, noting that the absence of local endpoint logs does not rule out the activity. Identity / Cloud: Correlate available Agentforce execution logs, Lead and Account lookups, and object and field permissions. Follow-up Verification: Cross-reference referenced Lead and Account fields with external DNS queries to determine the exfiltration scope and check for recurring processing. Containment: Preserve malicious leads and related evidence, restrict processing of untrusted input, and limit external resource retrieval. Verify the application of reported patches and identify potentially exfiltrated data. Triage: Record contact, initial execution, authentication and malware success, information compromise, and subsequent compromise separately. 11. Defense and Detection Ideas Single Event: Investigate instructions within external input, record lookups unrelated to business objectives, and unknown external URLs within responses. Timeline: Correlate lead creation, user queries, Account lookups, generated URLs, and DNS queries within the same processing timeline. Hunting: Cross-reference impact windows and asset inventories to retroactively search for matching IoCs and behaviors. Log Gaps: SaaS audit logs may not record all read operations or Slack-side DNS processing. Verify the availability limits of execution and communication logs. Priority Actions: Prioritize patch deployment, least privilege, outbound traffic control, and audit log retention. 12. Facts, Inference, and Hypothesis Facts Attackers saved natural language instructions into lead fields via public Web-to-Lead forms. When internal users initiated standard lead queries, the General CRM sub-agent read the malicious leads and embedded values retrieved from Accounts into the hostnames of attacker-controlled domains. Combining unknown .fun TLDs with {} or [] prevented Trusted URLs filtering from treating them as URLs, while browsers still interpreted them as image URLs. DNS queries occurred during the resolution of generated HTML image tags, leaking data within hostnames without permitting HTTP body access. Zenity reported the issue on June 1, 2026, Salesforce applied a patch on August 18, and Zenity confirmed the fix on August 19. Researchers also demonstrated an exfiltration path where external URLs were resolved via Slack link previews in addition to image rendering. Inference Outbound communication defenses for AI agents require monitoring not only HTTP allowlists but also DNS query names, specifically targeting boundaries where model outputs are interpreted as HTML or URLs. Hypothesis No additional hypotheses. Unverified items are listed in Open Questions and Further Investigation. 13. MITRE ATT&CK Mapping ID Technique Confidence Basis T1048 Exfiltration Over Alternative Protocol Medium Zenity's PoC embeds CRM data into DNS query names and retrieves it via an attacker's authoritative DNS server. The encryption method for DNS transport was not specified, mapping to the parent technique. 14. Open Questions and Further Investigation Whether the reported chain has been exploited in production environments. Whether other undisclosed paths exist beyond the reported Trusted URLs bypasses. Image rendering and Slack previews represent the two paths demonstrated in this research. 15. Impact on SOCs and Organizations Organizations operating Agentforce alongside Web-to-Lead integration should verify designs that prevent untrusted inputs from being elevated to trusted instructions, sub-agent object permissions, rich text rendering, and DNS monitoring. Because standard business queries alone can trigger the behavior, controls over data boundaries and outbound traffic take precedence over user awareness training. 16. Summary by Role SOC: Correlate Agentforce executions, long DNS labels targeting unknown domains, and concurrent Lead/Account lookups. Administrators: Verify patch status, restrict sub-agent permissions, public form inputs, HTML rendering, and outbound DNS traffic. Users: Standard inquiries can process malicious leads. Report suspicious external images or abnormal responses to administrators.