TechPrufer
Get started
Dropbox
Dropbox logoDropbox · Feature trail

SSRF Defense and Secure Request Framework

2 posts · Feb 2020 – Sep 2022

What this trail covers

Dropbox has implemented a comprehensive framework to defend against Server-Side Request Forgery (SSRF) attacks. This includes a specific fix for a critical SSRF vulnerability in the branded sharing feature, the development of a secure-by-default web request framework deployed at the network/proxy layer (Envoy with HTTP RBAC filter), and the 'Auth Everywhere' initiative mandating authenticated, authorized, and auditable connections in production. These measures significantly reduce the risk of SSRF attacks.

All Dropbox trails
  1. Defending against SSRF attacks (with help from our bug bounty program)This post details a critical SSRF vulnerability in Dropbox's branded sharing feature, stemming from inconsistent URL parsing between the URI library and urllib.parse, allowing attackers to craft malicious URLs that bypassed validation. A quick fix involved ensuring proper URL serialization and constructing URLs with the intended domain. To prevent future SSRF attacks, Dropbox developed a secure-by-default web request framework deployed at the network/proxy layer (Envoy with HTTP RBAC filter) to consistently parse URLs, validate IP addresses, and make requests, also recompiling libcurl to disable non-HTTP/HTTPS protocols. Additionally, the 'Auth Everywhere' initiative was launched, mandating mTLS connections for all production services to enforce authentication, authorization, and auditability, thereby reducing the attack surface and limiting the impact of compromised hosts.
  2. Dropbox bug bounty program has paid out over $1,000,000This post details a specific SSRF vulnerability found in the Paper document preview endpoint that bypassed shared link password protection. The vulnerability allowed an attacker to bypass password protection for shared links by sending a malicious link to the /integrations/embed/fetch/matte endpoint, enabling unauthorized access to document previews. The fix involved adding missing access control checks to the endpoint. The post also mentions a separate CSS injection vulnerability in Paper notifications that allowed for HTML injection and token exfiltration, which was fixed by addressing name validation and CSP rules. Additionally, a Gopher SSRF vulnerability was discovered where a 302 redirect allowed switching to the Gopher protocol, bypassing HTTP proxies and enabling access to internal services. The mitigation involved patching out unsupported protocols in libcurl.