Web Application Penetration Test Engagement Report

This document is a Detailed Letter of Engagement from NCC Group regarding a web application penetration test conducted for Salesforce, Inc. The assessment took place between November 7, 2022, and December 20, 2022, involving four consultants over sixty-six person-days. The review focused on Salesforce's Core Web applications as part of the Winter '22 Product Release, which included various components such as Sales Cloud, Service Cloud, and others. The primary objective was to identify application-level security issues that could impact the security of these applications. The testing was performed following NCC Group's standard methodology, utilizing both manual techniques and automated tools. Key areas of review included configuration issues, common web vulnerabilities, and authentication mechanisms. The assessment resulted in the identification of one medium severity vulnerability, three low severity vulnerabilities, and one informational finding, all of which were reported to Salesforce with recommendations for remediation.