City-Forum Campaign Exploits Salesforce & ServiceNow Misconfigurations to Steal Data
The 'City-Forum' campaign demonstrates how misconfigured SaaS portals can expose sensitive organizational data to anonymous, unauthenticated users without any exploitation of software vulnerabilities. Attackers leveraged overly permissive access settings in Salesforce Experience Cloud and ServiceNow customer portals — configurations that organizations frequently overlook during deployment or after platform updates. This matters because SaaS platforms are often assumed to be 'secure by default,' leading teams to underinvest in reviewing access controls and permission models. The multi-sector targeting (finance, telecom, public sector) highlights that no industry is immune when foundational configuration hygiene is neglected. Novel techniques against newer Salesforce frameworks also suggest attackers are actively researching platform-specific misconfigurations faster than defenders are auditing them.
Tactical Insight
Immediate actions
- Audit all Salesforce Experience Cloud and ServiceNow portal configurations to ensure no data objects or endpoints are accessible to anonymous or guest users.
- Revoke and review all public-facing API endpoints and guest-user profiles across SaaS platforms to enforce least-privilege access.
Long-term improvements
- Establish a recurring SaaS configuration review process (at minimum quarterly) that includes permission models, guest access, and sharing rules after every major platform update.
- Maintain an up-to-date inventory of all customer-facing portals and integrate them into your vulnerability management program with continuous posture monitoring.
- Adopt a Zero Trust access model for all SaaS portals, requiring authenticated and authorized sessions before exposing any business data.
Detection measures
- Deploy CASB (Cloud Access Security Broker) tooling to monitor and alert on anomalous data access patterns, particularly bulk record retrieval by unauthenticated or low-privilege users.
- Enable and centralize audit logging for all Salesforce and ServiceNow portal activity, and create SIEM alerts for guest-user data access events.
- Conduct regular third-party penetration tests targeting SaaS portal configurations, specifically focusing on unauthenticated access paths and newer platform frameworks.