Tracker

Vulnerabilities & CVEs

Named security defects in Dropbox's software — plus documented abuse of its platform — with severity, status, and sources. A serious record tracks the identifier-bearing flaws, not only the headline breaches.

CVE-2024-5924MediumPatched2024

Mark-of-the-Web bypass in the Dropbox Windows client

Files arriving via Dropbox sync could be written without the Windows 'Mark of the Web' flag, stripping SmartScreen/Protected-View warnings that protect users from running downloaded, untrusted content. Remediated in current client releases.

Affected: Dropbox desktop (Windows)

Full archive entry →cve.news — CVE-2024-5924 (Dropbox Desktop MOTW bypass)

CVE-2024-25718MediumPatched2024

Heap-buffer-overflow in Dropbox's Lepton image library

A heap-buffer-overflow in Lepton — Dropbox's open-source JPEG-recompression library used in its storage pipeline — could be triggered by a crafted image (in aligned_dealloc(), src/lepton/bitops.cc), leading to denial of service or possible escalation. Fixed in Lepton 1.2.1.

Affected: Lepton (Dropbox open-source image compression, < 1.2.1)

NVD — CVE-2024-25718 GitHub — dropbox/lepton issue #112 (heap-buffer-overflow)

Platform abuse (C2)MediumOngoing2024

Dropbox API abused as malware command-and-control

Not a flaw in Dropbox, but a recurring abuse: state-aligned groups (e.g. Kimsuky, ScarCruft) use the trusted Dropbox API as a command-and-control and exfiltration channel that blends into normal enterprise traffic.

Affected: Dropbox API

Full archive entry →TechJack Solutions — Dropbox abused-infrastructure rollup

CVE-2022-4768HighPatched2022

Injection / RCE in Dropbox's merou (Grouper) SSH key handler

A critical remote injection flaw in the add_public_key function of merou (Dropbox's open-source 'Grouper' authorization-management tool): the public_key_str argument was insufficiently validated, enabling code injection. Remotely exploitable; patched upstream.

Affected: merou / Grouper (Dropbox open-source authorization tool)

NVD — CVE-2022-4768 CloudDefense — CVE-2022-4768 (merou SSH public-key handler)

2019 client zero-dayHighPatched2019

Local privilege-escalation zero-day in the Dropbox Windows client

A researcher disclosed a privilege-escalation flaw in the Dropbox updater service on Windows that could let a low-privileged user gain SYSTEM rights. Dropbox patched the issue after disclosure.

Affected: Dropbox desktop (Windows)

The Register — coverage of the Dropbox Windows privilege-escalation flaw

Keeping the Dropbox desktop and mobile apps updated remediates the client-side issues above. See the breach tracker for full incident reports.

Mark-of-the-Web bypass in the Dropbox Windows client

Affected: Dropbox desktop (Windows)

Heap-buffer-overflow in Dropbox's Lepton image library

Affected: Lepton (Dropbox open-source image compression, < 1.2.1)

Dropbox API abused as malware command-and-control

Affected: Dropbox API

Injection / RCE in Dropbox's merou (Grouper) SSH key handler

Affected: merou / Grouper (Dropbox open-source authorization tool)

Local privilege-escalation zero-day in the Dropbox Windows client

A researcher disclosed a privilege-escalation flaw in the Dropbox updater service on Windows that could let a low-privileged user gain SYSTEM rights. Dropbox patched the issue after disclosure.

Affected: Dropbox desktop (Windows)