Salesforce DX command line interface (CLI) does not adequately protect sfdxurl credentials

guest · Oct 5, 2021

Salesforce DX command line interface (CLI) does not adequately protect sfdxurl credentials
Vulnerability Note VU#883754
October 4, 2021 (Last Revised: 2021-10-05)
https://kb.cert.org/vuls/id/883754

Overview
The default security configuration in Salesforce allows an authenticated user with the Salesforce-CLI to create URL that will allow anyone, anywhere access to the Salesforce GUI with the same administrative credentials without a log trace of access or usage of the API.
Impact
An unauthenticated user who gains access to an URL, generated by Salesforce-cli, can perform administrative actions as if logged in with the same rights as the account owner who generated the URL. This includes the ability to add user accounts that have administrative rights, manage existing users or applications, and any other action that is available to the user who generated the URL.
Click to expand...

Solution
In the Salesforce GUI you can Modify Session Security Settings, it is possible to Lock Sessions to the IP address that the session originated on, which would limit the ability for the URL to be shared with other hosts. The default configuration does not have this lock enabled because it may impact various applications and some mobile devices.
Click to expand...

Log in or Sign up

Salesforce DX command line interface (CLI) does not adequately protect sfdxurl credentials

guest Guest

Log in or Sign up

Salesforce DX command line interface (CLI) does not adequately protect sfdxurl credentials

guest Guest

Useful Searches