One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025
A single attacker operating from one VPS (158.220.87.79) has been scraping Salesforce and ServiceNow customer portals across multiple industries since at least March 2025 The campaign, dubbed "City Forum" by Reco, is notable for exploiting both Salesforce's older Aura framework and its newer Lightning Web Runtime UI-API, plus ServiceNow's undocumented search endpoint The root vulnerability is overly permissive guest user profiles on both platforms—guest identities that can read records make thos
Analysis
TL;DR
- A single attacker operating from one VPS (158.220.87.79) has been scraping Salesforce and ServiceNow customer portals across multiple industries since at least March 2025
- The campaign, dubbed "City Forum" by Reco, is notable for exploiting both Salesforce's older Aura framework and its newer Lightning Web Runtime UI-API, plus ServiceNow's undocumented search endpoint
- The root vulnerability is overly permissive guest user profiles on both platforms—guest identities that can read records make those records effectively public regardless of login requirements
- The attacker uses a purpose-built Go program with a distinctive net/http user agent fingerprint, enabling automated enumeration and data extraction at scale
- Remediation focuses on tightening guest profile permissions rather than blocking endpoints, since the exploited APIs are functioning as designed
Why It Matters
This campaign exposes a systemic misconfiguration pattern affecting thousands of enterprise SaaS deployments, where guest access profiles on Salesforce Experience Cloud and ServiceNow portals grant far more data visibility than intended. For AI and security practitioners, it highlights how automated scraping tools can exploit poorly restricted guest identities to exfiltrate sensitive customer data at scale, making it a critical case study in SaaS security and data exposure risk.
Technical Details
- Infrastructure: Single IP address (158.220.87.79) hosted on Contabo VPS in Germany, using a compiled Go program with the default
net/httpuser agent fingerprint; passive DNS traces activity back to March 2025 with no infrastructure changes - Salesforce exploitation: Attacks target both the legacy Aura framework (accounting for the bulk of traffic, with one victim logging 560,000+ events from the same IP) and the newer Lightning Web Runtime via the UI-API, systematically walking through API versions v56.0 through v66.0—a surface with no known public scanning tools
- ServiceNow exploitation: The same infrastructure targets the native Service Portal search endpoint (
POST /api/now/sp/search), which has minimal public documentation, enabling anonymous data retrieval through the portal search mechanism - Detection guidance: Salesforce defenders should monitor AuraRequest and Sites logs for the Go user agent, specific IP, paths containing
/webruntime/api/services/data, and spikes in self-registration at/SiteRegisterand/CommunitiesSelfReg; ServiceNow teams should filtersyslog_transactionby source IP and URLs starting with/api/now/sp/search, flagging guest-created rows with unusual output length - Root cause: Both platforms maintain a persistent, undeletable guest user that unauthenticated visitors execute as; if the guest profile has read access to a record, that record is effectively public regardless of portal login requirements
Industry Insight
- Organizations should conduct immediate audits of guest user profiles across all Salesforce Experience Cloud sites and ServiceNow portals, as the default configuration often grants excessive read permissions that turn seemingly private data into public records
- Security teams should treat the Go user agent fingerprint and known IP as active IOCs, implementing detection rules in SIEM and API security platforms before the campaign expands to additional targets
- The exploitation of undocumented or under-documented endpoints like ServiceNow's search API and Salesforce's UI-API underscores the need for comprehensive API inventory and access governance, particularly for surfaces that lack public threat intelligence or scanning tooling
Disclaimer: The above content is generated by AI and is for reference only.