City-Forum Campaign Harvests Data Exposed to Anonymous Users in Salesforce and ServiceNow Portals

It means the affected portals allowed access to certain records or endpoints without proper authentication. Instead of requiring a logged-in user with the right permissions, anonymous visitors could potentially view, query, or download data intended for specific roles. This typically points to misconfigured access controls, broken authorization checks, or unsafe public endpoints.

Attackers can automate requests to portal endpoints that were not meant to be public, enumerate identifiers (like record IDs), and scrape any responses that the server incorrectly returns. Even if the UI hides data, backend APIs or download functions may still expose it. Weak rate limiting and predictable resource URLs make harvesting more efficient.

While it depends on the specific environment and configuration, portal leaks often involve customer or user profile information, support/ticket content, incident details, attachments, and metadata that helps enumerate records. Sometimes attackers can also access configuration or workflow-related data that reveals internal structure. The key risk is not just content, but the ability to link and reconstruct sensitive records.

Organizations should validate portal endpoints and APIs that serve data, testing whether requests succeed without authentication and whether authorization is enforced per user role. Review access control logic, check for publicly reachable routes, and verify that server-side permission checks exist—not only UI restrictions. Logging and alerting on anomalous unauthenticated queries can help confirm exposure.

Fix misconfigurations by enforcing strict authentication and role-based authorization for every data-returning API and download endpoint. Remove or lock down anonymous access settings where not explicitly required, sanitize any public views, and ensure server-side checks match intended permissions. Add rate limiting, monitor suspicious traffic patterns, and patch any recently identified platform-specific issues.

Because leaks can be subtle: the portal may work as expected for typical users while still exposing a small set of endpoints to anonymous callers. Attackers can harvest large volumes quickly with automation, so time matters. Early investigation also helps determine scope, identify the exact exposed routes, and prevent attackers from refining their methods using new findings.