Full Report
AuraInspector automates the most common abuses and generates fixes for customers Mandiant has released an open source tool to help Salesforce admins detect misconfigurations that could expose sensitive data.…
Analysis Summary
# Tool/Technique: AuraInspector
## Overview
AuraInspector is an open-source security tool released by Mandiant designed to help Salesforce administrators detect and remediate common security misconfigurations within Salesforce environments, specifically targeting issues related to the Aura UI framework for Experience Cloud sites that could lead to sensitive data exposure.
## Technical Details
- Type: Tool
- Platform: Salesforce (Cloud/Web Application)
- Capabilities: Automates testing for common abuses related to Aura components; generates recommended fixes; performs read-only scans.
- First Seen: January 2026 (based on article date reference)
## MITRE ATT&CK Mapping
The tool focuses on reconnaissance and impact prior to a full exploit, primarily targeting configuration weaknesses.
- **TA0025 - Resource Development** (Potentially, by identifying necessary components for an attack)
- **T1589 - Gather Victim Identity Information** (If misconfigurations expose user/record identifiers)
- **TA0001 - Initial Access** (If misconfigurations grant unauthorized access)
- **T1190 - Exploit Configuration Opportunities** (Related to exploiting misconfigurations)
*(Note: Since AuraInspector is a defensive/detection tool, the mapping reflects the techniques it is designed to detect, not the tool's inherent malicious use.)*
## Functionality
### Core Capabilities
- Automates the detection of common abuses against Salesforce Aura components.
- Specifically targets **access control issues** in Aura components used in Experience Cloud sites.
- Generates recommended **remediation strategies** for identified misconfigurations.
- Operations are strictly **read-only**, ensuring the tool does not modify Salesforce instances.
### Advanced Features
- Identifies potential data exposure resulting from abusing methods like `getItems` on the `Account` object when accessible by unauthenticated users.
- Can help prevent attackers from gaining unauthorized access to **Record Lists** and **admin panels** via misconfigured **Home URLs**.
- Checks for exposure risks associated with the default configuration of the **GraphQL API** accessible by guest accounts.
## Indicators of Compromise
*As AuraInspector is a legitimate detection tool, it does not generate IoCs indicative of compromise unless its output logs are analyzed.*
- File Hashes: N/A (Open source repository)
- File Names: N/A
- Registry Keys: N/A
- Network Indicators: N/A (Operations are internal to the Salesforce platform environment)
- Behavioral Indicators: N/A (The tool *simulates* malicious behavior patterns for detection purposes)
## Associated Threat Actors
- Mandiant (Developer of the defense tool)
*(Note: The article mentions threat actors and groups leveraging these misconfigurations—such as unknown actors targeting banks and healthcare providers—but does not attribute the abuse of the specific vulnerabilities found by AuraInspector to a specific named threat group in the context of tool usage.)*
## Detection Methods
- **Signature-based detection:** Not applicable, as it's a configuration scanning tool, not malware. Detection relies on specific scanner outputs.
- **Behavioral detection:** Security teams can monitor API calls and system logs for unusual configuration scanning activity matching AuraInspector's testing methodology if the tool itself is operating maliciously or if an attacker mimics its pattern.
- **YARA rules:** Not applicable.
## Mitigation Strategies
- Properly configure object access controls within Salesforce to restrict what guest and unauthenticated users can view.
- Review and restrict access to the GraphQL API for guest accounts unless explicitly required and secured.
- Audit Aura components for the use of insecure methods (like `getItems` exposure) that lack proper authorization checks.
- Migrate away from legacy Aura components where possible in favor of Lightning Web Components (LWC).
- Regularly use tools like AuraInspector to proactively check for misconfigurations.
## Related Tools/Techniques
- Salesforce Experience Cloud Site Misconfigurations (General technique)
- GraphQL API abuse via misconfigurations
- Attackers bypassing record limits via manipulation of sort orders or API abuses.
- Varonis Salesforce security warnings/research.