Dropbox bug bounty program has paid out over $1,000,000

This post details a specific SSRF vulnerability found in the Paper document preview endpoint that bypassed shared link password protection. The vulnerability allowed an attacker to bypass password protection for shared links by sending a malicious link to the /integrations/embed/fetch/matte endpoint, enabling unauthorized access to document previews. The fix involved adding missing access control checks to the endpoint. The post also mentions a separate CSS injection vulnerability in Paper notifications that allowed for HTML injection and token exfiltration, which was fixed by addressing name validation and CSP rules. Additionally, a Gopher SSRF vulnerability was discovered where a 302 redirect allowed switching to the Gopher protocol, bypassing HTTP proxies and enabling access to internal services. The mitigation involved patching out unsupported protocols in libcurl.