Web vulnerability affecting shared links

We wanted to let you know about a web vulnerability that impacted shared links to files containing hyperlinks. We’ve taken steps to address this issue and you don’t need to take any further action.

For background, whenever you click on a link in any browser, the site you’re going to learns where you came from by something called a referer header. The referer header was designed to enable websites to better understand traffic sources. This is standard practice implemented across all browsers.

Dropbox users can share links to any file or folder in their Dropbox. Files shared via links are only accessible to people who have the link. However, shared links to documents can be inadvertently disclosed to unintended recipients in the following scenario:

• A Dropbox user shares a link to a document that contains a hyperlink to a third-party website.
• The user, or an authorized recipient of the link, clicks on a hyperlink in the document.
• At that point, the referer header discloses the original shared link to the third-party website.
• Someone with access to that header, such as the webmaster of the third-party website, could then access the link to the shared document.

While we’re unaware of any abuse of this vulnerability, for your safety we’ve taken the following steps to make sure this vulnerability can’t be exploited:

• For previously shared links to such documents, we’ve disabled access entirely until further notice. We’re working to restore links that aren’t susceptible to this vulnerability over the next few days.
• In the meantime, as a workaround, you can re-create any shared links that have been turned off.
• For all shared links created going forward, we’ve patched the vulnerability.
• Additionally, if you’re a Dropbox for Business customer, you have the option to restrict shared link access to people in your Dropbox for Business team. Links created with those access controls were not affected.

We realize that many of your workflows depend on shared links, and we apologize for the inconvenience. We’ll continue working hard to make sure your stuff is safe and keep you updated on any new developments.

Update [5/6/2014] — We’re aware of a second issue that’s been reported about shared links. This involves a user entering a shared link into a search engine and the search engine passing that link on to ad partners. This is well known and we don’t consider it a vulnerability. We urge everyone to be careful about providing shared links to third parties like search engines (read more in this help center article).