Einstein’s Wormhole Exposes Salesforce Calendars to Potential Hackers

  • Salesforce’s Einstein Activity Capture has shown a bug giving access to external users.
  • The bug has been removed by the Salesforce team with a new update.
  • Salesforce user teams can change guest ID parameters to cover for the bug if they do not have the latest version.

Salesforce Communities and Einstein Activity Capture (EAC) can lead to a compromise of the administrator’s Outlook or Google calendar through a bug the Varonis research team discovered, naming it Einstein’s Wormhole. Calendars used by admins may contain highly sensitive information, including attendee names and emails, file attachments, meeting URLs and passwords, agendas, and email replies.

The issue has been reported to the Salesforce team and they have fixed it as of August 19, so if your Salesforce Community was created prior to this date, you must remediate exposed calendar events.

The EAC is used to sync emails and calendar events between Microsoft Exchange, Google accounts, and Salesforce. If a user leaves access open with a meeting link, hackers could gain passwords and infiltrate a meeting without being noticed.

source: Varonis

Short of getting the latest upgrade, the most effective way of securing against the Einstein Wormhole bug is to change your guest ID parameters. First, you must replace your guest user’s email with something like "test[@]example.com" or "guest[@]yourcompany.com." After that, remove all confidential information accessible via the guest account.

source: Varonis

You can do this via the Development Console option in your Salesforce app and access the “Execute Anonymous Window.” Next, “Execute” the code above to change the email address used by guests.

US Darts Masters 2023 Live Stream: How to Watch Online from Anywhere
The tension is palpable, and the excitement is high ahead of what promises to be another captivating edition of the US Darts...
Spanish Grand Prix Live Stream 2023: How to Watch Formula 1 Online from Anywhere
The thrills of the 2023 Formula 1 season continue this weekend with the Spanish Grand Prix. Another blistering race lies in store...
How to Watch Love ALLways Online: Stream LGBTQ+ Dating Show from Anywhere
Love ALLways is a new reality TV dating show, and we have all the important details you may be searching for, including...
For a better user experience we recommend using a more modern browser. We support the latest version of the following browsers: For a better user experience we recommend using the latest version of the following browsers: Chrome, Edge, Firefox, Safari