Executive brief
Workbench, a tool used by administrators and developers to manage Salesforce organizations, contains a critical security flaw that allows for remote code execution. An attacker can exploit this by sending specially crafted web requests (cookies) to the application, potentially gaining full control over the server. This could lead to the theft of sensitive Salesforce credentials, unauthorized data access, or a complete compromise of the administrative environment.
Technical details
A remote code execution (RCE) vulnerability exists in Workbench prior to version 65.0.0 within the timezone conversion logic. The root cause is the unsafe use of the deprecated PHP function 'create_function()' in the 'localizeDateTimes()' component, which processes user-supplied data from cookies without adequate validation. An unauthenticated remote attacker can inject arbitrary PHP code via crafted cookie values, leading to full system compromise. The vulnerability was addressed in version 65.0.0 by replacing 'create_function()' with anonymous closures and implementing stricter input validation for configuration values derived from cookies.
Affected products
- forceworkbench Workbench < 65.0.0
Timeline
- 2026-03-27: patched: Fix merged into main branch via Pull Request 869
- 2026-04-01: advisory: GitHub Security Advisory GHSA-jw63-m86r-2jxc published
- 2026-04-06: disclosed: CVE-2026-35178 published to NVD