SL Cyber has disclosed a chain of five vulnerabilities in Salesforce Marketing Cloud — the email marketing, campaign management, and customer journey platform used by enterprises globally — that in combination allowed an authenticated marketing user to access the complete contacts database, historical email content, and engagement data across the entire Marketing Cloud instance.
Salesforce has patched the vulnerabilities. However, the disclosure has implications for data governance and GDPR compliance that persist after patching: organisations should assess what data was accessible to which marketing team roles and whether access controls were correctly scoped.
The Vulnerability Chain
The most critical vulnerability in the chain is a server-side template injection (SSTI) flaw in the AMPscript and SSJS (Server-Side JavaScript) template rendering components used in Marketing Cloud’s email composition interface. Marketing Cloud allows users to write dynamic email templates using AMPscript — a proprietary templating language — and SSJS — a server-side JavaScript environment.
The SSTI vulnerability allowed AMPscript or SSJS code to escape its intended execution scope and access Marketing Cloud server-side objects that should not be reachable from template code. Specifically, the exploit enabled:
- Full contacts database access: The vulnerability allowed retrieval of all subscriber records, contact attributes, and list memberships across the entire Marketing Cloud account — including contacts that the authenticated user’s role should not have access to under Marketing Cloud’s data extension access control model
- Historical email access: Sent email content, engagement metadata, and link click data for historical campaigns was accessible via the same server-side object access
- Credential exposure: In configurations where Marketing Cloud integration credentials or API keys were stored as data extension attributes, these were within scope of the SSTI exfiltration
The remaining four vulnerabilities in the disclosure include a cross-site scripting flaw in the Journey Builder component, an insecure direct object reference in the content builder, and two lower-severity information disclosure issues.
Scope of Data at Risk
Salesforce Marketing Cloud is used specifically for contact management and campaign delivery — its data is inherently high-sensitivity from a privacy perspective:
- Contact databases typically contain customer PII including names, email addresses, phone numbers, purchase history attributes, and behavioural data derived from email engagement
- In healthcare and financial services deployments, contact attributes may include account numbers, patient identifiers, or other regulated data
- Historical email content may contain time-sensitive transactional communications, reset links, or account information
The practical question for affected organisations is not just “was this patched?” but “was any data accessed prior to patching?” Salesforce has not indicated confirmed exploitation, but the research team discovered the vulnerability during a security assessment — meaning it existed in a patchable-but-exploitable state for an undisclosed period.
Actions for Marketing Cloud Customers
Verify patching: Confirm your Salesforce Marketing Cloud instance is running the patched version by checking the platform release notes available in Marketing Cloud’s Setup menu. Salesforce patches cloud SaaS automatically — verify the patch applied date.
Review Marketing Cloud audit logs: Marketing Cloud’s audit trail should show API access events and template rendering activity. Review for anomalous data export events, unusual API activity, or large contact data retrieval operations in the period preceding the patch.
Assess data extension access controls: Marketing Cloud’s role-based access control allows scoping of which data extensions (contact databases) specific users or roles can access. If your deployment uses shared access to all data extensions for marketing users, this vulnerability would have provided access to the full dataset. Review whether your current role configuration is appropriately scoped.
GDPR notification consideration: If your organisation is subject to GDPR and your Marketing Cloud instance contains EU residents’ personal data, assess whether there is evidence of pre-patch exploitation that would require a breach notification to your supervisory authority under the 72-hour notification requirement.
The vulnerability is a reminder that marketing platforms containing large contact databases require the same security scrutiny as CRM and ERP systems — the data is the same, regardless of whether the platform’s primary purpose is “marketing” rather than “data management.”
Share this article