SOQL Injection Flaw Exposes Millions of Records in Salesforce Deployments

Security researcher Tobia Righi discovered a previously undocumented and exploitable SOQL injection vulnerability in Salesforce’s default CsvDataImportResourceFamilyController, affecting potentially millions of user records across Salesforce deployments. The vulnerability allows an attacker to exfiltrate document and user information using crafted queries, even bypassing significant SOQL limitations. Despite its severity, the issue was quietly patched without a CVE or public advisory.

Severity Level: High

Vulnerability Details

• Name: SOQL Injection in CsvDataImportResourceFamilyController
• Type: Server-side SOQL Injection
• Component Affected: Default Aura controller in Salesforce deployments
• Parameter Affected: contentDocumentId

Root Cause

Salesforce’s controller CsvDataImportResourceFamilyController directly embedded the user-supplied contentDocumentId parameter into an SOQL query without sanitization or parameterization, exposing the application to injection vectors.

Exploitation

• Fuzzing of default Aura controllers revealed malformed error responses to injected values.
• Blind injection via response discrepancy exploited the SOQL logic.
• The researcher used predictable Salesforce ContentDocumentIds to bruteforce valid documents.
• Enumeration allowed access to user metadata and documents, including emails and potential password hashes.
• Scripts were used to generate ID sequences and automate extraction.

Affected Products

Salesforce instances using default Aura framework and CsvDataImportResourceFamilyController.
All versions prior to the unannounced patch (likely patched post-April 2025, but no public version tag provided).

Fixed Version Information

Status: Quietly patched by Salesforce.
The vulnerability is no longer exploitable as of June 2025.

Recommendations

1. Regularly monitor and apply Salesforce updates.
2. If still using older Salesforce instances:
   • Disable/Restrict access to CsvDataImportResourceFamilyController.
   • Monitor and sanitize all Aura controller parameters, especially object IDs.
   • Implement WAF rules to detect abnormal patterns targeting Aura endpoints.

Source:

• https://cybersecuritynews.com/soql-injection-0-day-vulnerability/
• https://mastersplinter.work/research/salesforce-sqli/

Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn

No related posts found.