T09 · Insecure Skill Coding Practices
- Location
scripts/crm.py:155- Finding
Salesforce SOQL Injection Through Unsanitized Email Input
- Content
View full analysis
Vulnerability Details
File Location:
scripts/crm.py, lines 155-163
Vulnerability Type: Salesforce Object Query Language injection
Risk Level: HighVulnerable Code
python if email: query = f""" SELECT Id, Name, Email, Phone, Account.Name FROM Contact WHERE Email LIKE '%{email}%' LIMIT {limit} """ else:Technical Analysis
The value supplied through the
--emailcommand-line argument is inserted directly into a Salesforce Object Query Language query using an f-string. The application does not validate the value as an email address or escape characters that have special meaning inside a SOQL string literal.An attacker who can control the command-line arguments can provide an input containing quote characters and additional SOQL syntax. This can terminate the intended email pattern and modify the query predicate. The integer
limitdoes not create the same injection issue becauseargparseparses it withtype=int, but it does not mitigate injection throughemail.The Salesforce SDK executes the resulting query with the permissions of the Salesforce account configured through
SALESFORCE_USERNAME,SALESFORCE_PASSWORD, andSALESFORCE_SECURITY_TOKEN.Attack Path
- An attacker gains the ability to invoke the Skill or influence the value passed to
--email. - The attacker supplies a crafted value containing SOQL string delimiters and predicate syntax.
query_salesforce()embeds that value directly inside theWHERE Email LIKEclause.- Salesforce executes the modified query under the configured account's privileges.
- Matching contact records are printed to standard output.
- If
--outputis also specified, the returned records are serialized to the selected JSON file.
Impact Assessment
Successful exploitation can bypass the intended email filter and disclose Salesforce contact data, including names, email ...[truncated 423 chars]
- An attacker gains the ability to invoke the Skill or influence the value passed to
- Remediation
View remediation
Remediation Suggestions
- Avoid directly interpolating untrusted values into SOQL statements.
- Use a supported Salesforce SDK query-binding or safe query-formatting mechanism where available.
- Escape SOQL string literals with a well-tested library routine before constructing the query.
- Strictly validate
--emailas an email address if partial searches are not required. - If partial matching is required, define a conservative character allowlist and reject quote characters, control characters, and SOQL metacharacters.
- Enforce a safe upper and lower bound for
--limit. - Configure the Salesforce integration account with least-privilege object and field permissions.
- Avoid printing or exporting unnecessary personal information.
A hardened implementation should validate the input and use a dedicated escaping function rather than relying on manual string replacement.