That's a design choice to make sharing links easier, of course. 'The problem lies in Dropbox and Box not requiring users accessing a shared link to authenticate themselves,' security expert Graham Cluley wrote on his blog.

Advertisementĭocuments can also get scooped up by advertising servers when users paste shared links into a search engine box rather than a browser's URL bar, and then click on an ad.

Through these links, we gained access to confidential files including tax returns, bank records, mortgage applications, blueprints and business plans-all highly sensitive information, some perhaps sufficient for identity theft and other crimes.'īox told Ars that it will be issuing a statement on the weakness soon. IntraLinks said that 'During a routine analysis of Google AdWords and Google Analytics data mentioning competitors’ names (Dropbox and Box), we inadvertently discovered the fully clickable URLs necessary to access these documents that led us to live folder contents, some with sensitive data. The flaw was discovered by file-sharing company IntraLinks, which was purchasing ads that would appear on Google when people search for the names of its competitors. Someone with access to that header, such as the webmaster of the third-party website, could then access the link to the shared document.ĭropbox said it's not aware of this vulnerability being exploited.At that point, the referrer header discloses the original shared link to the third-party website.The user, or an authorized recipient of the link, clicks on a hyperlink in the document.A Dropbox user shares a link to a document that contains a hyperlink to a third-party website.However, shared links to documents can be inadvertently disclosed to unintended recipients in the following scenario: 'Dropbox users can share links to any file or folder in their Dropbox,' the company noted yesterday while confirming the vulnerability:įiles shared via links are only accessible to people who have the link. The flaw, which is reportedly also present on Box, impacts shared files that contain hyperlinks. Dropbox has disabled access to previously created shared links to certain kinds of documents after the discovery that some users' sensitive files-including tax returns and bank records-were exposed through Google AdWords campaigns.

Password protected dropbox link