Ghost Sites: The Hidden Threat in Deactivated Salesforce Communities

In the realm of cybersecurity, the discovery of improperly deactivated Salesforce "ghost" Sites has raised significant concerns. These sites, which are easily found, accessible, and exploitable by attackers, pose a considerable risk to sensitive Personally Identifiable Information (PII) and business data. This blog post delves into the details of this discovery, as reported by Varonis.

The Genesis of Ghost Sites

Salesforce Sites enable the creation of customised communities for collaboration within a company’s Salesforce environment. However, when these communities are no longer needed, they are often set aside but not properly deactivated. This lack of proper deactivation leads to the creation of "ghost" sites, which continue to pull fresh data and remain accessible and exploitable by attackers.

The Risk of Ghost Sites

Ghost sites originate from custom domain names created by companies to replace unappealing internal URLs. When a company replaces a Salesforce Experience Site with an alternative, the custom domain's DNS record is modified, but the custom domain is not removed or deactivated in Salesforce. As a result, ghost sites remain active in Salesforce but are disconnected from the new community page, making them vulnerable to exploitation.

Exploiting Ghost Sites

Attackers can exploit ghost sites by manipulating the host header, tricking Salesforce into serving the site to the attacker. These sites may contain confidential data, including PII and sensitive business data, which can be accessed by threat actors.

Mitigating the Risks of Ghost Sites

To mitigate the risks associated with ghost sites, sites that are no longer in use should be properly deactivated. It is crucial for Salesforce users to ensure their sites are properly deactivated and regularly monitored for suspicious activity. Regular security audits, timely patching of vulnerabilities, and robust access control measures are also recommended best practices to protect against the threat of ghost sites.

The discovery of improperly deactivated Salesforce "ghost" Sites serves as a stark reminder of the ever-evolving landscape of cybersecurity threats. It underscores the need for enhanced defenses, proper site deactivation, and adaptability to counter such threats.