City-Forum Attacks Target Salesforce and ServiceNow Data via Guest Portals
City-Forum Attacks: Exploiting Salesforce and ServiceNow Guest Portals
A data-theft campaign dubbed “City-Forum” is actively harvesting records from Salesforce Experience Cloud and ServiceNow customer portals by targeting misconfigured unauthenticated guest access points. According to security researchers at Reco, the attackers are utilizing custom tooling to interact with UI-API layers, leveraging legitimate, albeit overly permissive, guest-user configurations.
The Tech TL;DR:
- Attack Vector: The campaign exploits “anonymous guest” permissions in Salesforce and ServiceNow to enumerate and exfiltrate data through UI-API endpoints, rather than traditional vulnerability exploits.
- Infrastructure: Attacks originate from a single server (IP 158.220.87.79) hosted by Contabo, associated with the city-forum.com domain since at least March 2025 and utilizing a Go-http-client/1.1 fingerprint.
- Risk Exposure: Organizations using Salesforce Aura, Lightning Web Runtime (LWR), or ServiceNow Service Portals are at risk if guest sharing rules are not strictly scoped.
The campaign, first identified by Reco, demonstrates a high level of technical reconnaissance. Unlike brute-force attacks against credentials, City-Forum functions by mapping internal data structures through guest-accessible APIs. As noted by BleepingComputer, this activity is not a result of software vulnerabilities but rather a failure of access control implementation within the SaaS configuration layer.
Architectural Exploitation: Inside the UI-API Layer
The attackers target the Aura framework in Salesforce by sending requests to /aura or /s/sfsites/aura, specifically invoking HostConfigController.getConfigData to map available objects before using SelectableListDataProviderController.getItems to pull record sets. The actor also uses the newer Lightning Web Runtime (LWR) framework, where they interact with the UI API via GraphQL requests at /webruntime/api/services/data/{version}/graphql.
By mapping ServiceNow Service Portal search endpoints—which Reco says have almost no online documentation—the actors demonstrate an approach to identifying non-standardized data leaks.
Mitigation and IT Triage
Disclaimer: The technical analyses and security protocols detailed in this article are for informational purposes only. Always consult with certified IT and cybersecurity professionals before altering enterprise networks or handling sensitive data.