CVE-2026-35178: Salesforce Workbench RCE Vulnerability

CVE-2026-35178 Overview

CVE-2026-35178 is a critical remote code execution (RCE) vulnerability in Workbench, a popular suite of tools used by administrators and developers to interact with Salesforce.com organizations via the Force.com APIs. The vulnerability exists in the timezone conversion flow, which processes attacker-controlled cookie values in an unsafe manner, leading to code injection (CWE-94). This vulnerability affects all versions prior to 65.0.0.

Critical Impact

Attackers can achieve remote code execution by crafting malicious cookie values that are processed unsafely during timezone conversion, potentially compromising the integrity and confidentiality of Salesforce organization data and connected systems.

Affected Products

• Workbench versions prior to 65.0.0
• Salesforce Workbench installations using the vulnerable timezone conversion flow
• Self-hosted Workbench deployments with exposed web interfaces

Discovery Timeline

• 2026-04-06 - CVE-2026-35178 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-35178

Vulnerability Analysis

This vulnerability stems from improper handling of user-controlled input in the timezone conversion functionality of Workbench. The application processes cookie values without adequate sanitization or validation, allowing an attacker to inject malicious code that gets executed on the server. Since Workbench serves as an administrative interface for Salesforce organizations, successful exploitation could grant attackers access to sensitive organizational data, API credentials, and the ability to perform administrative actions within connected Salesforce instances.

The attack requires user interaction, as the victim must have an active Workbench session for the malicious cookies to be processed. However, the network-accessible nature of the vulnerability and the lack of authentication requirements for the initial attack vector make it a significant threat to organizations using Workbench.

Root Cause

The root cause is a code injection vulnerability (CWE-94) where the timezone conversion flow directly processes attacker-controlled cookie values without proper input validation or sanitization. The application fails to implement secure coding practices when handling external input, allowing arbitrary code to be interpreted and executed within the application context.

Attack Vector

The attack is delivered over the network and requires user interaction. An attacker crafts malicious cookie values that, when processed by the timezone conversion functionality during a legitimate user session, result in code execution. The attacker does not require any prior privileges on the system. Successful exploitation impacts both the vulnerable system and potentially connected downstream Salesforce systems, leading to high confidentiality and integrity impact.

The vulnerability mechanism involves the unsafe processing of cookie data during timezone conversion operations. When a user with an active session accesses functionality that triggers the timezone conversion flow, the malicious payload embedded in the cookie is evaluated and executed. For detailed technical information, refer to the GitHub Security Advisory GHSA-jw63-m86r-2jxc.

Detection Methods for CVE-2026-35178

Indicators of Compromise

• Unusual or malformed cookie values containing code-like structures or escape sequences in Workbench-related requests
• Unexpected server-side execution or process spawning from Workbench application contexts
• Anomalous outbound network connections originating from Workbench server processes
• Log entries showing timezone conversion errors with unusual payloads

Detection Strategies

• Implement web application firewall (WAF) rules to inspect and block requests with suspicious cookie patterns targeting Workbench endpoints
• Monitor application logs for timezone conversion flow anomalies and error patterns that may indicate exploitation attempts
• Deploy endpoint detection and response (EDR) solutions to identify unexpected code execution from web application processes
• Perform regular security audits of Workbench configurations and access logs

Monitoring Recommendations

• Enable detailed logging for all Workbench application requests, particularly those involving session and cookie handling
• Configure alerting for unusual process creation or network activity from systems hosting Workbench
• Monitor for bulk or automated requests to timezone-related functionality that may indicate scanning or exploitation attempts

How to Mitigate CVE-2026-35178

Immediate Actions Required

• Upgrade Workbench to version 65.0.0 or later immediately
• Restrict network access to Workbench instances to trusted IP ranges and authenticated users only
• Review access logs for any signs of exploitation attempts prior to patching
• Implement additional authentication controls for administrative interfaces

Patch Information

The vulnerability has been fixed in Workbench version 65.0.0. The patch addresses the unsafe processing of cookie values in the timezone conversion flow by implementing proper input validation and sanitization. Organizations should review the GitHub Pull Request #869 for technical details on the fix and the GitHub Security Advisory GHSA-jw63-m86r-2jxc for complete remediation guidance.

Workarounds

• If immediate patching is not possible, consider temporarily disabling public access to Workbench instances
• Implement strict Content Security Policy (CSP) headers to limit code execution contexts
• Deploy a reverse proxy with request filtering to sanitize cookie values before they reach the Workbench application
• Use network segmentation to isolate Workbench deployments from critical infrastructure

# Example: Restrict Workbench access via nginx reverse proxy
# Add to nginx server block configuration
location /workbench/ {
    # Limit access to trusted IP ranges
    allow 10.0.0.0/8;
    allow 192.168.1.0/24;
    deny all;
    
    # Add security headers
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'" always;
    add_header X-Content-Type-Options "nosniff" always;
    
    proxy_pass http://workbench-backend;
}