Defending against SSRF attacks (with help from our bug bounty program)

This post details a critical SSRF vulnerability in Dropbox's branded sharing feature, stemming from inconsistent URL parsing between the URI library and urllib.parse, allowing attackers to craft malicious URLs that bypassed validation. A quick fix involved ensuring proper URL serialization and constructing URLs with the intended domain. To prevent future SSRF attacks, Dropbox developed a secure-by-default web request framework deployed at the network/proxy layer (Envoy with HTTP RBAC filter) to consistently parse URLs, validate IP addresses, and make requests, also recompiling libcurl to disable non-HTTP/HTTPS protocols. Additionally, the 'Auth Everywhere' initiative was launched, mandating mTLS connections for all production services to enforce authentication, authorization, and auditability, thereby reducing the attack surface and limiting the impact of compromised hosts.