Full Report
Cybersecurity researchers have uncovered over 20 configuration-related risks affecting Salesforce Industry Cloud (aka Salesforce Industries), exposing sensitive data to unauthorized internal and external parties. The weaknesses affect various components like FlexCards, Data Mappers, Integration Procedures (IProcs), Data Packs, OmniOut, and OmniScript Saved Sessions. "Low-code platforms such as
Analysis Summary
# Vulnerability: Salesforce Industry Cloud Configuration Risks and SOQL Injection
## CVE Details
- CVE ID: CVE-2025-43697, CVE-2025-43698, CVE-2025-43699, CVE-2025-43700, CVE-2025-43701 (plus 16 unassigned configuration risks)
- CVSS Score: 5.3 (Low/Medium for CVE-2025-43699), 7.5 (High for CVE-2025-43700 & CVE-2025-43701), N/A (For CVE-2025-43697 & CVE-2025-43698)
- CWE: Configuration Management Issues, Access Control Issues
## Affected Systems
- Products: Salesforce Industry Cloud (formerly Salesforce Industries), components including FlexCards, Data Mappers, Integration Procedures (IProcs), Data Packs, OmniOut, and OmniScript Saved Sessions.
- Versions: Not specified, but applies to deployments where the identified security settings are not correctly configured.
- Configurations: Primarily related to missing security configurations related to Field Level Security, Data Encryption checks, 'Required Permissions', and Guest User access controls within Industry Cloud components.
## Vulnerability Description
The research uncovered over 20 configuration-related risks in Salesforce Industry Cloud. Several specific CVEs detail security bypasses due to improper configuration:
1. **CVE-2025-43697**: If 'Check Field Level Security' is disabled for 'Extract' and 'Turbo Extract Data Mappers', the 'View Encrypted Data' permission check fails, exposing cleartext data for encrypted fields.
2. **CVE-2025-43698**: The SOQL data source bypasses Field-Level Security (FLS) when fetching data from Salesforce objects.
3. **CVE-2025-43699**: FlexCard does not enforce the 'Required Permissions' field for the OmniUlCard object.
4. **CVE-2025-43700**: FlexCard fails to enforce the 'View Encrypted Data' permission, returning plaintext for data encrypted with Classic Encryption.
5. **CVE-2025-43701**: FlexCard permits Guest Users to access values for Custom Settings.
Additionally, a separate **unnamed zero-day SOQL Injection** was reported in a default aura controller (`aura://CsvDataImportResourceFamilyController/ACTION$getCsvAutoMap`) due to unsafe embedding of the user-controlled `contentDocumentId` parameter, allowing potential arbitrary query execution.
## Exploitation
- Status: Salesforce states they have *not* observed any evidence of exploitation in customer environments for the CVEs. The SOQL Injection zero-day disclosure implies the potential for active exploitation, though Salesforce confirmed resolution before public observation of exploitation.
- Complexity: Likely **Medium** for configuration flaws, requiring knowledge of Industry Cloud setup errors. **Medium** to **High** for the SOQL injection, as it requires knowledge of ID structures and potential brute-forcing (using publicly available scripts) to enumerate valid ContentDocument IDs.
- Attack Vector: **Network** (for remote exploitation of configuration flaws or SOQLi).
## Impact
- Confidentiality: **High**. Unauthorized access to encrypted customer/employee data, session data, and credentials.
- Integrity: **Medium/High**. Potential to manipulate data or business logic via SOQL injection or data access.
- Availability: **Low**. Primary focus is data exposure, not service disruption.
## Remediation
### Patches
Salesforce has addressed the issues identified in the research:
* Patches/fixes related to the configuration/code issues have been made available to customers.
* The SOQL Injection vulnerability was promptly investigated and resolved by Salesforce.
### Workarounds
* For CVE-2025-43697 and CVE-2025-43698, customers must enable the new security setting **`EnforceDMFLSAndDataEncryption`**. Enabling this setting ensures only users with the "View Encrypted Data" permission can see plaintext data returned by the Data Mapper.
* Customers must review and correctly implement security configurations across FlexCards, Data Mappers, and other components mentioned, as the majority of findings stem from customer configuration errors.
## Detection
- **Indicators of Compromise (IoC)**: Unusual data retrieval patterns, unexpected access to encrypted fields in plaintext, or database errors indicative of injection attempts in Aura/API logs.
- **Detection Methods and Tools**: Review Salesforce configuration settings, specifically ensuring FLS and encryption checks are mandated. For the SOQLi vulnerability, intrusion detection systems should monitor for anomalous input in the `contentDocumentId` parameter within Aura controller actions.
## References
- Vendor advisory/Correction documentation (specific versions not provided in source).
- For FLS/Encryption enforcement: [hxxps://www.reddit.com/r/salesforce/comments/1kqs14d/omni_security_notification_potential_data/]
- SOQL Injection path details: [hxxps://mastersplinter.work/research/salesforce-sqli/]
- Salesforce ID generation script reference: [hxxps://github.com/hypn/misc-scripts/blob/master/salesforce-id-generator.py]