CVE-2025-64320

Executive Summary

CVE-2025-64320 is a critical code injection vulnerability in the Salesforce Agentforce Vibes Extension, stemming from improper neutralization of input used for LLM prompting. This flaw allows an attacker to inject arbitrary code into the LLM processing pipeline, potentially leading to remote code execution, data exfiltration, or unauthorized actions within the Salesforce ecosystem. The vulnerability affects all versions prior to 3.2.0. No public proof-of-concept or exploit code has been released at this time, but the risk is elevated due to the widespread use of Salesforce Agentforce in enterprise environments.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby) but is a proprietary Salesforce extension. However, organizations should review their Salesforce AppExchange installations and ensure that the Agentforce Vibes Extension is updated to version 3.2.0 or later. Supply chain risk is mitigated by Salesforce's managed distribution, but manual verification of extension versions is recommended.

CVSS Breakdown & Threat Level

The CVSS score is currently listed as 0.0, likely due to incomplete or pending analysis. Based on the vulnerability type (CWE-94: Code Injection) and the context (LLM prompting in a Salesforce environment), the following CVSS vector is estimated:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires authenticated access to the extension.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Changed (C) – Impact may extend beyond the vulnerable component.
• Confidentiality (C): High (H) – Potential data exfiltration.
• Integrity (I): High (H) – Code injection can modify data or behavior.
• Availability (A): High (H) – Could lead to denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Estimated Base Score: 9.9 (Critical)

Threat Level: Critical – Immediate patching is required.

Deep Dive & Mechanics

The vulnerability resides in the Agentforce Vibes Extension, which integrates LLM capabilities into Salesforce workflows. The extension fails to properly sanitize user-supplied input before passing it to the LLM prompt. This allows an attacker to inject malicious instructions or code that the LLM may execute or return as part of its response.

Attack Flow:

1. An authenticated user with access to the Agentforce Vibes Extension crafts a malicious input containing code injection payloads.
2. The extension processes this input without proper neutralization, embedding it into an LLM prompt.
3. The LLM interprets the injected code as part of its instructions, potentially executing arbitrary commands or returning sensitive data.
4. The attacker receives the LLM's output, which may include exfiltrated data or confirmation of code execution.

Technical Details:

• The vulnerability is classified as CWE-94: Improper Control of Generation of Code ('Code Injection').
• The affected component is the prompt construction logic within the extension.
• No specific technical details about the injection syntax have been publicly disclosed.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-3.2.0):

# Example of vulnerable prompt construction
def build_prompt(user_input):
    prompt = f"User query: {user_input}\nRespond appropriately."
    return prompt

Patched Code (3.2.0+):

# Example of patched prompt construction with input sanitization
import html

def build_prompt(user_input):
    sanitized_input = html.escape(user_input)
    prompt = f"User query: {sanitized_input}\nRespond appropriately."
    return prompt

The patch introduces input sanitization (e.g., HTML escaping) to prevent injection of malicious code into the LLM prompt. Additional validation and context-aware filtering may also be implemented.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Access to a Salesforce instance with Agentforce Vibes Extension version < 3.2.0.
• Valid credentials for a user with permission to use the extension.

Exploitation Steps:

1. Identify the input field that feeds into the LLM prompt (e.g., a chat interface or API endpoint).
2. Craft a payload that injects code into the prompt. Example payloads:
   • "; system('cat /etc/passwd'); //
   • {{ config }} (if using Jinja2 templating)
   • $(cat /etc/shadow)
3. Submit the payload and observe the LLM's response for signs of code execution or data leakage.
4. Use the injected code to pivot to other systems or exfiltrate data.

Lab Setup:

• Deploy a vulnerable Salesforce sandbox with Agentforce Vibes Extension version 3.1.9.
• Use a tool like Burp Suite or Postman to interact with the extension's API.
• Monitor logs for successful injection attempts.

Blue Team (Defensive)

Detection:

• Monitor for unusual LLM responses containing system commands or sensitive data.
• Implement input validation and sanitization on all user-supplied data before passing to LLM prompts.
• Use Web Application Firewalls (WAF) to block common injection patterns.

Hunting:

• Search logs for payloads containing shell metacharacters (;, |, $, `).
• Review LLM output logs for unexpected data or error messages.

Mitigation:

• Immediately upgrade to Agentforce Vibes Extension version 3.2.0 or later.
• If patching is not possible, disable the extension or restrict access to trusted users only.
• Implement strict output filtering on LLM responses to prevent data leakage.

Indicators of Compromise (IOCs)

• Network Indicators:
  • Unusual outbound connections from Salesforce to external IPs.
  • LLM responses containing system commands or sensitive data.
• File Indicators:
  • Modified configuration files in the extension directory.
  • Unexpected files created in the Salesforce environment.
• Log Indicators:
  • Log entries with injection payloads (e.g., ;, |, $).
  • Repeated failed authentication attempts to the extension.
• Behavioral Indicators:
  • Unauthorized data access or exfiltration.
  • Unexpected changes to Salesforce records or workflows.

Detection Engineering

YARA Rule

rule CVE_2025_64320_LLM_Injection {
    meta:
        description = "Detects potential LLM injection payloads targeting Salesforce Agentforce Vibes Extension"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64320"
    strings:
        $injection1 = /[\;\|\$\`]\s*(system|exec|shell_exec|passthru|eval|assert)/
        $injection2 = /\{\{.*config.*\}\}/
        $injection3 = /\$\(.*\)/
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-64320 - LLM Injection Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects potential LLM injection payloads in Salesforce Agentforce Vibes Extension logs
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: salesforce
detection:
    selection:
        - EventID: "LLM_Prompt"
          Payload|contains:
              - "; system("
              - "| system("
              - "$(cat"
              - "{{ config }}"
    condition: selection
falsepositives:
    - Legitimate use of shell commands in non-LLM contexts
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-64320 - LLM Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"/agentforce/vibes"; http_uri; pcre:"/(\;\s*system\s*\(|\|\s*system\s*\(|\$\(cat|\{\{.*config.*\}\})/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade the Agentforce Vibes Extension to version 3.2.0 or later.
2. If immediate patching is not possible, disable the extension or restrict access to trusted users.
3. Review and tighten input validation for all LLM-related components.

Long-Term Measures:

• Implement a security review process for all Salesforce extensions.
• Use context-aware sanitization for LLM prompts.
• Monitor for similar vulnerabilities in other LLM integrations.

Workarounds:

• Apply a WAF rule to block common injection patterns.
• Use a reverse proxy to inspect and sanitize requests to the extension.

Valters IT – Securing your digital frontier.