Researchers identified the City-Forum campaign exploiting unauthenticated guest user access on Salesforce Experience Cloud (Aura and LWR) and ServiceNow platforms. The attack uses a custom Go-based toolset to enumerate and exfiltrate data exposed to guest users without requiring authentication. The campaign targets sectors including telecom, finance, enterprise software, and public sector portals. It leverages the inherent existence of guest users in these platforms, which cannot be deleted and may have overly permissive read access. The ServiceNow attack focuses on a poorly documented search endpoint. The campaign is notable for its stealth, using a single IP address over an extended period to reduce detection risk. No evidence of platform breaches or authenticated user exploitation has been observed, but the potential for escalation exists if self-registration is enabled. The campaign differs from previous Aura-targeting attacks by integrating multi-platform targeting and a custom toolset.

The campaign enables attackers to quietly enumerate and exfiltrate data that is publicly exposed to unauthenticated guest users on Salesforce and ServiceNow platforms. This can lead to significant data leakage from targeted organizations, including telecoms, financial services, enterprise software vendors, and public sector portals. Although no platform breaches or authenticated user exploits have been observed, the exposure of sensitive data due to misconfigured guest user permissions poses a serious confidentiality risk. The stealthy nature and high-volume but protocol-legitimate exfiltration make detection challenging.

Organizations should immediately verify and restrict guest user permissions on Salesforce and ServiceNow platforms to ensure no sensitive data is exposed to unauthenticated users. Disable self-registration features in Salesforce Experience Cloud to prevent guest users from upgrading to authenticated users, which could increase data exposure. Review and tighten sharing rules, profiles, and code running in the context of guest users. Monitor for unusual enumeration activity and consider blocking known malicious IP addresses associated with the campaign. Follow vendor advisories and security best practices for these platforms to reduce exposure.