Legacy Encryption in Salesforce Marketing Cloud

The article examines vulnerabilities in Salesforce Marketing Cloud (formerly ExactTarget) related to the use of outdated cryptographic mechanisms. The research shows that parameters in email links are encrypted using weak or legacy algorithms, allowing an attacker to decrypt and tamper with them without knowledge of the key.

Exploitation is based on a combination of attacks, including padding oracle techniques, enabling access to subscriber data and email content.

📎 Article: https://slcyber.io/research-center/ghosts-of-encryption-past-salesforce-exacttarget/

💬 Discuss