Web vulnerability exposes shared links in Dropbox

Share this article:

A web vulnerability, which the company says has been addressed, can cause Dropbox users to inadvertently share links to sensitive documents and information, according to a blog penned by Dropbox Vice President of Engineering Aditya Agarwal.

When a Dropbox user shares a link to a document that includes a hyperlink to a third-party website and the recipient clinks on the hyperlink, a referer header reveals the original shared link to the third-party site.

“Someone with access to that header, such as the webmaster of the third-party website, could then access the link to the shared document,” Agarwal wrote.

Dropbox hasn't found any instances of the vulnerability being exploited but has disabled access entirely for the time being and has patched the vulnerability. Dropbox for Business users, who have the ability to restrict shared link access, are not affected.

Share this article:

Sign up to our newsletters

More in News

Instagram iOS and Android apps vulnerable to session hijacking

Two researchers wrote about the Instagram app for iOS and Android is vulnerable to session hijacking because both send unsecured information through HTTP.

Report: Hackers stole data from Israeli defense firms

A report by Brian Krebs detailed the intrusions, which occurred between Oct. 2011 and Aug. 2012.

Neverquest trojan targets regional banks in Japan

Symantec researchers found a new variant of the banking trojan.