A stranger has been reading Salesforce and ServiceNow portals worldwide for 17 months

A persistent cybersecurity campaign has been exploiting guest user permissions on Salesforce and ServiceNow portals worldwide for at least seventeen months, according to recent research reported by helpnetsecurity.com. This activity involves repeated, anonymous data requests to publicly accessible customer portals, resulting in unauthorized access to potentially sensitive information without exploiting software vulnerabilities or requiring credentials.

The campaign, tracked under the moniker City-Forum, employs a dedicated server registered since 2002 but reactivated in March 2025 to systematically pull data from various industries, including telecom, finance, software vendors, and public sector portals. Researchers from the cybersecurity firm Reco discovered that the attacker operates entirely within the designed functionality of these platforms, leveraging the default guest user accounts to browse and enumerate portal content.

These guest accounts, integral to both Salesforce Experience Cloud and ServiceNow instances, are non-removable and are assigned permissions configured by the portal administrators. The attacker’s approach capitalizes on the gap between what is publicly accessible and what should be public, targeting instances where guest user permissions were overly permissive. This misconfiguration enabled the attacker to access significant amounts of data without triggering conventional security alerts.

Notably, while threats exploiting Salesforce guest users have been documented previously, this campaign differentiates itself by developing a custom toolset rather than utilizing available off-the-shelf software. The bulk of Salesforce-related activity concentrated on Aura framework endpoints, a known target for guest enumeration, generating over half a million logged events in some cases. However, the campaign also probed less examined areas, including Salesforce’s newer site framework and an undocumented ServiceNow portal search API, revealing offensive blind spots in both platforms.

The ServiceNow search endpoint, particularly, is designed as public but varies in its data exposure depending on backend configuration. Some data sources enforce login requirements, whereas others rely solely on assigned read permissions, which can inadvertently allow anonymous users to retrieve knowledge base content. The attacker’s strategy involved detailed reconnaissance to map portal contents by analyzing response sizes, a technique highlighting the nuanced differences between legitimate public access and data leakage.

Despite extensive activity, the logs available to portal managers provide limited insight into the exact data accessed. While Salesforce logs indicate the nature and volume of guest user requests, they do not disclose which specific records or fields were viewed or extracted. Similarly, ServiceNow transaction logs document search attempts but omit the query terms, complicating retrospective analysis. Consequently, organizations must replicate anonymous user interactions internally to ascertain the extent of data exposure.

Security experts emphasize that the root cause lies in over-permissioned guest user configurations, with Salesforce’s guest sharing rules representing a critical point of remediation. However, addressing this involves more than adjusting permissions; it requires comprehensive audits and configuration reviews, particularly on ServiceNow, where permissions settings are less straightforward.

This prolonged and methodical campaign underscores the importance of distinguishing between publicly intended content and inadvertently exposed private data. The risk is heightened where sensitive personal or proprietary information is accessible without authentication, necessitating prompt customer notifications if such data has been compromised.

From a broader perspective, the findings reveal systemic challenges in SaaS portal security, where default functional elements like guest accounts can become vectors for data exposure if not carefully managed. This situation calls for platform providers to enhance configuration guidance and for users to rigorously evaluate their public interface permissions.

In the context of music industry platforms that rely on Salesforce or ServiceNow for customer support or content delivery, these vulnerabilities pose risks to artist data, fan information, and operational integrity. As the industry increasingly depends on such cloud services, understanding and mitigating these exposures become vital to safeguarding artist catalogues, tour-related data, and fan engagement channels.

While attribution of the City-Forum campaign remains undisclosed, its scale and duration suggest a meticulously planned operation with significant reconnaissance and technical expertise. This scenario emphasizes the evolving nature of cybersecurity threats in enterprise cloud environments and the necessity for continuous monitoring alongside proactive permission management.

Ultimately, this case demonstrates that even well-designed software platforms can harbor security risks through misconfiguration rather than code flaws, urging organizations to prioritize configuration audits and align public-facing data exposure with their actual privacy policies and compliance obligations.