Dropbox
Monthly
Unauthenticated memory exhaustion in the Erlang esaml SAML library (version 0.1.0 and later) lets a remote attacker crash the hosting Erlang VM by posting a small, highly compressed SAMLResponse to a service provider's assertion-consumer (ACS) or single-logout endpoint. Because esaml_binding:decode_response/2 base64-decodes and inflates the attacker-supplied payload with zlib:unzip/1 before any signature check, a deflate stream with roughly 1000:1 amplification expands tens of kilobytes into hundreds of megabytes of binary and then gigabytes of charlist heap, so only a handful of requests are needed to take the node down. No public exploit code or confirmed active exploitation was identified at time of analysis, but the issue is trivially reachable on any internet-facing esaml service provider and upstream fix commits are already published.
Unauthenticated remote denial of service in the Erlang SAML library esaml (0.1.0 and later) allows an attacker to abort an Erlang node by exhausting its atom table through unsigned LogoutResponse messages posted to a Service Provider's single-logout endpoint. Because esaml_sp:validate_logout_response/2 only verifies a signature when one is present, an unsigned message reaches esaml:decode_logout_response/1, where status_code_map/1 converts each unrecognized StatusCode into a permanent atom with list_to_atom/1 - roughly one million distinct status values (the VM's default atom-table ceiling) are enough to crash the node. The CNA scored this CVSS 4.0 8.2 with the AT:P attack-requirement metric; the practical barrier is volume and time rather than skill, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Authentication bypass via SAML assertion replay affects Samly, the Elixir/Plug SAML 2.0 Service Provider library from Dropbox, in all releases from v0.3.0 onward. Because Samly.Helper.decode_idp_auth_resp/3 invokes esaml's validate_assertion with a no-op duplicate detector and exposes no way to supply a real one, a bearer assertion is never enforced as single-use; an attacker who captures a single valid SAMLResponse can resubmit the identical bytes to repeatedly log in as that assertion's subject until its NotOnOrAfter expires. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Authentication bypass in the Elixir SAML library samly (v0.3.0+) allows an attacker holding a validly IdP-signed SAML assertion to establish an authenticated session on the service provider without the SP ever having issued the corresponding AuthnRequest. The root cause is that Samly.SPHandler.validate_authresp/3 never persists the AuthnRequest ID and therefore cannot compare it against the SubjectConfirmationData/@InResponseTo attribute in incoming responses, violating SAML 2.0 Core §4.1.4.3. No public exploit has been identified at time of analysis, but the attack is technically accessible to any party who holds a legitimately signed IdP assertion and can obtain a victim's RelayState value.
DNS rebinding in Dropbox's mcp-server-dash (network mode) allows a malicious web page to reach the local MCP listener and invoke Dropbox API tools - company-search and file-detail - under the victim's stored Dropbox credential. The server bound to the loopback interface but performed no Host header validation, letting a browser issue cross-origin requests via a rebound domain that resolves to 127.0.0.1. No public exploit has been identified at time of analysis; CVSS 4.0 scores this at 2.3, reflecting the attack's prerequisites of user interaction and a specific deployment mode.
A SSRF vulnerability (CVSS 6.3) that allows an attacker. Remediation should follow standard vulnerability management procedures.
Dropbox Desktop Folder Sharing Mark-of-the-Web Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In the Samly package before 1.4.0 for Elixir, Samly.State.Store.get_assertion/3 can return an expired session, which interferes with access control because Samly.AuthHandler uses a cached session and. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A vulnerability was found in Dropbox merou. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Dropbox Lepton v1.2.1-185-g2a08b77 was discovered to contain a heap-buffer-overflow in the function aligned_dealloc():src/lepton/bitops.cc:108. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Dropbox.exe (and QtWebEngineProcess.exe in the Web Helper) in the Dropbox desktop application 71.4.108.0 store cleartext credentials in memory upon successful login or new account creation. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in the com.dropbox.android application 98.2.2 for Android. Rated low severity (CVSS 3.6). No vendor patch available.
An issue was discovered in the com.dropbox.android application 98.2.2 for Android. Rated low severity (CVSS 3.1), this vulnerability is no authentication required. No vendor patch available.
An issue was discovered in the com.getdropbox.Dropbox app 100.2 for iOS. Rated medium severity (CVSS 6.4), this vulnerability is no authentication required. No vendor patch available.
An issue was discovered in Dropbox Lepton 1.2.1. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Dropbox SDK for Android before 1.6.2 might allow remote attackers to obtain sensitive information via crafted malware or via a drive-by download attack. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Dropbox Lepton 1.2.1 allows DoS (SEGV and application crash) via a malformed lepton file because the code does not ensure setup of a correct number of threads. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
The allocate_channel_framebuffer function in uncompressed_components.hh in Dropbox Lepton 1.2.1 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Unauthenticated memory exhaustion in the Erlang esaml SAML library (version 0.1.0 and later) lets a remote attacker crash the hosting Erlang VM by posting a small, highly compressed SAMLResponse to a service provider's assertion-consumer (ACS) or single-logout endpoint. Because esaml_binding:decode_response/2 base64-decodes and inflates the attacker-supplied payload with zlib:unzip/1 before any signature check, a deflate stream with roughly 1000:1 amplification expands tens of kilobytes into hundreds of megabytes of binary and then gigabytes of charlist heap, so only a handful of requests are needed to take the node down. No public exploit code or confirmed active exploitation was identified at time of analysis, but the issue is trivially reachable on any internet-facing esaml service provider and upstream fix commits are already published.
Unauthenticated remote denial of service in the Erlang SAML library esaml (0.1.0 and later) allows an attacker to abort an Erlang node by exhausting its atom table through unsigned LogoutResponse messages posted to a Service Provider's single-logout endpoint. Because esaml_sp:validate_logout_response/2 only verifies a signature when one is present, an unsigned message reaches esaml:decode_logout_response/1, where status_code_map/1 converts each unrecognized StatusCode into a permanent atom with list_to_atom/1 - roughly one million distinct status values (the VM's default atom-table ceiling) are enough to crash the node. The CNA scored this CVSS 4.0 8.2 with the AT:P attack-requirement metric; the practical barrier is volume and time rather than skill, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Authentication bypass via SAML assertion replay affects Samly, the Elixir/Plug SAML 2.0 Service Provider library from Dropbox, in all releases from v0.3.0 onward. Because Samly.Helper.decode_idp_auth_resp/3 invokes esaml's validate_assertion with a no-op duplicate detector and exposes no way to supply a real one, a bearer assertion is never enforced as single-use; an attacker who captures a single valid SAMLResponse can resubmit the identical bytes to repeatedly log in as that assertion's subject until its NotOnOrAfter expires. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Authentication bypass in the Elixir SAML library samly (v0.3.0+) allows an attacker holding a validly IdP-signed SAML assertion to establish an authenticated session on the service provider without the SP ever having issued the corresponding AuthnRequest. The root cause is that Samly.SPHandler.validate_authresp/3 never persists the AuthnRequest ID and therefore cannot compare it against the SubjectConfirmationData/@InResponseTo attribute in incoming responses, violating SAML 2.0 Core §4.1.4.3. No public exploit has been identified at time of analysis, but the attack is technically accessible to any party who holds a legitimately signed IdP assertion and can obtain a victim's RelayState value.
DNS rebinding in Dropbox's mcp-server-dash (network mode) allows a malicious web page to reach the local MCP listener and invoke Dropbox API tools - company-search and file-detail - under the victim's stored Dropbox credential. The server bound to the loopback interface but performed no Host header validation, letting a browser issue cross-origin requests via a rebound domain that resolves to 127.0.0.1. No public exploit has been identified at time of analysis; CVSS 4.0 scores this at 2.3, reflecting the attack's prerequisites of user interaction and a specific deployment mode.
A SSRF vulnerability (CVSS 6.3) that allows an attacker. Remediation should follow standard vulnerability management procedures.
Dropbox Desktop Folder Sharing Mark-of-the-Web Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In the Samly package before 1.4.0 for Elixir, Samly.State.Store.get_assertion/3 can return an expired session, which interferes with access control because Samly.AuthHandler uses a cached session and. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A vulnerability was found in Dropbox merou. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Dropbox Lepton v1.2.1-185-g2a08b77 was discovered to contain a heap-buffer-overflow in the function aligned_dealloc():src/lepton/bitops.cc:108. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Dropbox.exe (and QtWebEngineProcess.exe in the Web Helper) in the Dropbox desktop application 71.4.108.0 store cleartext credentials in memory upon successful login or new account creation. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in the com.dropbox.android application 98.2.2 for Android. Rated low severity (CVSS 3.6). No vendor patch available.
An issue was discovered in the com.dropbox.android application 98.2.2 for Android. Rated low severity (CVSS 3.1), this vulnerability is no authentication required. No vendor patch available.
An issue was discovered in the com.getdropbox.Dropbox app 100.2 for iOS. Rated medium severity (CVSS 6.4), this vulnerability is no authentication required. No vendor patch available.
An issue was discovered in Dropbox Lepton 1.2.1. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Dropbox SDK for Android before 1.6.2 might allow remote attackers to obtain sensitive information via crafted malware or via a drive-by download attack. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Dropbox Lepton 1.2.1 allows DoS (SEGV and application crash) via a malformed lepton file because the code does not ensure setup of a correct number of threads. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
The allocate_channel_framebuffer function in uncompressed_components.hh in Dropbox Lepton 1.2.1 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available.