CVE-2024-39344: Docusign API for Salesforce Disclosure Flaw

CVE-2024-39344 Overview

CVE-2024-39344 is an information disclosure vulnerability in the Docusign API package version 8.142.14 for Salesforce. The Apttus_DocuApi__DocusignAuthentication__mdt custom metadata object stores configuration data that can be read by low-privileged users when the package is installed with default "all users" settings. Attackers who query the object's fields can extract authentication key material and combine those components to mint a valid Docusign API session. The disclosed session typically belongs to an administrator service account, granting broad control over the tenant's Docusign integration. The issue is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
A low-privileged Salesforce user can read the metadata object, reconstruct Docusign API credentials, and impersonate an administrator service account across the Docusign tenant.

Affected Products

Docusign API package for Salesforce, version 8.142.14
Salesforce orgs where the package was installed with the default "Install for All Users" option
Apttus_DocuApi__DocusignAuthentication__mdt custom metadata records provisioned by the package

Discovery Timeline

2024-08-21 - CVE-2024-39344 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-39344

Vulnerability Analysis

The Docusign API package installs a custom metadata type named Apttus_DocuApi__DocusignAuthentication__mdt in the target Salesforce org. Custom metadata records are readable by any authenticated user with access to the metadata type, and Salesforce does not scope field-level reads on these records the same way it does for regular sObjects. When the package is installed for all users, records of this type expose configuration fields that hold Docusign integration secrets.

An authenticated Salesforce user without administrator rights can issue a SOQL query against the metadata object and read the stored fields. The disclosed values include the components needed to authenticate against the Docusign API on behalf of the integration service account. Because the integration is registered as an administrator with impersonation rights, the attacker can then act as any Docusign user reachable through the same authorization flow.

Root Cause

The root cause is insecure default configuration combined with sensitive material stored in a low-privilege-readable location. Custom metadata was designed for configuration values that ship with a package, not long-lived authentication secrets. Placing Docusign session-forming credentials in this object and shipping the package with a permissive default install profile lets any authenticated org user retrieve those secrets.

Attack Vector

The attack requires an authenticated Salesforce session with the low baseline privileges granted to any user in an org that installed the package. The attacker queries the Apttus_DocuApi__DocusignAuthentication__mdt records through SOQL, the Salesforce Metadata API, or the developer console, extracts the stored fields, and assembles them into an authenticated Docusign API request. Once the session is established, the attacker can invoke Docusign administrative endpoints and re-authenticate as targeted users through the same OAuth-style flow the service account is authorized to perform.

No verified public exploit code is available. Technical detail on the disclosure chain is documented in the Deneyed research write-up.

Detection Methods for CVE-2024-39344

Indicators of Compromise

SOQL queries or Metadata API calls from non-administrator users referencing Apttus_DocuApi__DocusignAuthentication__mdt
Docusign API sessions originating from IP addresses or user agents that do not match the sanctioned Salesforce integration host
Unexpected login or token requests to the Docusign API using the integration service account outside normal automation windows
New Docusign envelopes, template modifications, or user impersonation events tied to the service account with no corresponding Salesforce workflow trigger

Detection Strategies

Enable Salesforce Event Monitoring and alert on ApiEvent and RestApiEvent records where the queried object equals Apttus_DocuApi__DocusignAuthentication__mdt
Correlate Salesforce login telemetry with Docusign audit logs to flag Docusign sessions that are not preceded by an authorized Salesforce integration call
Baseline the accounts and IP ranges that legitimately query the metadata object, then alert on any deviation

Monitoring Recommendations

Forward Salesforce Event Monitoring logs and Docusign audit trails into a centralized data lake for cross-source correlation and long-term retention
Monitor for privilege changes, new connected apps, and new API tokens in the Docusign tenant, especially those attributed to the integration service account
Review installed managed packages weekly and flag any package whose install profile is set to "All Users" when it exposes credential metadata

How to Mitigate CVE-2024-39344

Immediate Actions Required

Restrict access to the Apttus_DocuApi__DocusignAuthentication__mdt object by re-installing or reconfiguring the package for "Admins Only" rather than "All Users"
Rotate the Docusign integration credentials, API keys, and service account tokens that the package stored in the exposed metadata
Review Docusign audit logs for the past 90 days for suspicious sessions, impersonation events, and envelope activity tied to the integration account
Restrict Docusign API access to known Salesforce integration IP ranges where the Docusign tenant supports IP allowlisting

Patch Information

Upgrade the Docusign API package for Salesforce beyond version 8.142.14 to a release that no longer stores authentication material in a broadly readable custom metadata object. Consult the vendor for the current fixed package version and reinstall using an install profile that limits access to administrators. The current package can be retrieved from the Salesforce package installation link referenced in the advisory.

Workarounds

Reinstall the package with the "Install for Admins Only" option and remove the metadata read permission from standard profiles and permission sets
Move sensitive Docusign secrets out of custom metadata and into Salesforce Named Credentials or Protected Custom Settings that enforce stricter access control
Revoke and reissue any Docusign account keys that may have been exposed while the permissive default was in place
Disable user impersonation on the Docusign service account if the integration does not require it

bash

# Example: query the exposed object to confirm exposure in your org
# Run as a low-privileged user in the Salesforce Developer Console
SELECT DeveloperName, MasterLabel
FROM Apttus_DocuApi__DocusignAuthentication__mdt