Dropbox Warns of Web Vulnerability That Affected Your Shared Links

Dropbox has just posted on their company blog about a web vulnerability that was affecting shared Dropbox links to files, which were possibly viewed by a third party website:

We wanted to let you know about a web vulnerability that impacted shared links to files containing hyperlinks. We’ve taken steps to address this issue and you don’t need to take any further action.

For background, whenever you click on a link in any browser, the site you’re going to learns where you came from by something called a referer header. The referer header was designed to enable websites to better understand traffic sources. This is standard practice implemented across all browsers.

Dropbox users can share links to any file or folder in their Dropbox. Files shared via links are only accessible to people who have the link. However, shared links to documents can be inadvertently disclosed to unintended recipients in the following scenario:

• A Dropbox user shares a link to a document that contains a hyperlink to a third-party website.
• The user, or an authorized recipient of the link, clicks on a hyperlink in the document.
• At that point, the referer header discloses the original shared link to the third-party website.
• Someone with access to that header, such as the webmaster of the third-party website, could then access the link to the shared document.

Dropbox says they are “unaware’ of any abuse of this exploit, but they have taken steps to ensure the safety of your data. Previously shared links to documents no longer are accessible until further notice and all new shared links going forward have been patched.

The ability to share links directly to your Dropbox files and folders debuted back in April of 2012.