City-Forum Attacks Expose Data Through Public Portals

The City-Forum attacks reveal how easily a public portal can be exploited for data exfiltration. Researchers from Reco have investigated an ongoing operation targeting telecommunications companies, banks, enterprise software providers, and public utilities.

The primary access point is the Guest User account used for unlogged visitors in Salesforce's Experience Cloud and ServiceNow. Attackers are looking at older Aura implementations and newer LWR sites in Salesforce, and public Service Portals in ServiceNow where search sources may return content without sufficient authentication.

A single Go binary communicates with Aura, LWR, and ServiceNow from the same machine. In Salesforce, requests to /aura are used to list available objects and retrieve records, while in LWR sites, data collection goes through the UI API and GraphQL. The image suggests a custom-built tool rather than simply using a ready-made scanner.

The campaign leverages the /api/now/sp/search to retrieve content from a portal’s search sources in ServiceNow. The activity may appear perfectly legitimate at the protocol level because it uses normal service functionality, explaining why large-scale data extraction is not always easy to distinguish from normal usage.

The most heavily trafficked Salesforce environment recorded more than 560,000 events, mostly enumeration actions via guest access. The objects that could be exposed depend on each organization’s settings and could include accounts, contacts, cases, files, or knowledge content.