IntraLinks said that 'During a routine analysis of Google AdWords and Google Analytics data mentioning competitors’ names (Dropbox and Box), we inadvertently discovered the fully clickable URLs necessary to access these documents that led us to live folder contents, some with sensitive data. The flaw was discovered by file-sharing company IntraLinks, which was purchasing ads that would appear on Google when people search for the names of its competitors.

Someone with access to that header, such as the webmaster of the third-party website, could then access the link to the shared document.ĭropbox said it's not aware of this vulnerability being exploited.At that point, the referrer header discloses the original shared link to the third-party website.

The user, or an authorized recipient of the link, clicks on a hyperlink in the document.

A Dropbox user shares a link to a document that contains a hyperlink to a third-party website.

However, shared links to documents can be inadvertently disclosed to unintended recipients in the following scenario: 'Dropbox users can share links to any file or folder in their Dropbox,' the company noted yesterday while confirming the vulnerability:įiles shared via links are only accessible to people who have the link. The flaw, which is reportedly also present on Box, impacts shared files that contain hyperlinks. Dropbox has disabled access to previously created shared links to certain kinds of documents after the discovery that some users' sensitive files-including tax returns and bank records-were exposed through Google AdWords campaigns.

Dropbox links list