CVE-2024-5924

CVE-2024-5924 is a Mark-of-the-Web bypass vulnerability affecting Dropbox Desktop, specifically when handling shared folders. An attacker can exploit this by sharing malicious files from an untrusted account, which the Dropbox desktop application then syncs without applying the Mark-of-the-Web. This allows for arbitrary code execution on the victim's system, requiring user interaction to open the malicious file or visit a malicious page. The vulnerability carries a CVSS score of 8.8 (High), indicating a critical severity. It has a network attack vector and low attack complexity, but requires user interaction (UI:R). Successful exploitation can lead to high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). Currently, there is no evidence of active exploitation, nor are there public exploit modules available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, which is typical for a large percentage of reported vulnerabilities.