CVE-2024-5924: Dropbox Desktop RCE Vulnerability

CVE-2024-5924 Overview

CVE-2024-5924 is a Mark-of-the-Web (MOTW) bypass vulnerability in Dropbox Desktop. The flaw resides in how the application handles shared folders synced from untrusted accounts. When the Dropbox client synchronizes files from a shared folder belonging to another user, it fails to apply the MOTW tag to the resulting local files. Attackers can abuse this gap to deliver executable content that Windows treats as locally trusted, bypassing SmartScreen and Protected View defenses. Exploitation requires user interaction, such as opening the synced file. Successful exploitation results in arbitrary code execution in the context of the current user. The issue was reported through the Zero Day Initiative as ZDI-CAN-23991.

Critical Impact
Attackers can execute arbitrary code as the logged-in user by sharing a malicious file through a Dropbox folder, evading Windows MOTW-based defenses.

Affected Products

Dropbox Desktop version 198.4.7615
Windows installations using Dropbox folder sharing
Users syncing files from untrusted Dropbox accounts

Discovery Timeline

2024-06-13 - CVE-2024-5924 published to NVD
2024-11-23 - Last updated in NVD database

Technical Details for CVE-2024-5924

Vulnerability Analysis

The vulnerability is a security feature bypass classified under [CWE-693] (Protection Mechanism Failure). Mark-of-the-Web is a Windows mechanism that tags files originating from untrusted zones using an alternate data stream named Zone.Identifier. Applications like Microsoft Office, Windows Defender SmartScreen, and PowerShell rely on this tag to apply stricter execution and macro policies. Dropbox Desktop omits this tag when writing files synced from a shared folder owned by another account. The attack vector is network-based with low complexity and requires no privileges, only user interaction with the synced file.

Root Cause

The sync routine in the Dropbox desktop client does not propagate web-origin metadata to files arriving from shared folders. Files downloaded through a browser receive a Zone.Identifier ADS marking them as Zone 3 (Internet). Dropbox writes synced files directly to disk without this stream, so the operating system treats them as locally created. The trust boundary between an untrusted remote sharer and the local user is not enforced at the file system layer.

Attack Vector

An attacker shares a folder containing a weaponized file, such as a macro-enabled Office document, an LNK shortcut, or an HTA file, with a target Dropbox user. Once the target accepts the shared folder, the Dropbox client downloads and writes the payload to the local sync directory without applying MOTW. When the user opens the file, Office bypasses Protected View, SmartScreen does not prompt, and macros or scripts execute with the user's privileges. No verified public proof-of-concept code is available; see the Zero Day Initiative Advisory ZDI-24-677 for technical context.

Detection Methods for CVE-2024-5924

Indicators of Compromise

Files in the local Dropbox sync directory lacking a Zone.Identifier alternate data stream despite originating from an external sharer
Office documents with macros, HTA, LNK, or script files appearing in shared Dropbox folders from untrusted accounts
Child processes such as winword.exe or excel.exe spawning powershell.exe, cmd.exe, or wscript.exe from the Dropbox folder path

Detection Strategies

Monitor process creation events where parent processes execute from %USERPROFILE%\Dropbox\ and spawn scripting interpreters
Audit alternate data streams on files within Dropbox sync directories and flag inconsistencies between source (shared) and MOTW state
Correlate Dropbox sync events with subsequent file execution to identify suspicious workflow patterns

Monitoring Recommendations

Enable PowerShell script block logging and Sysmon Event ID 1 and 11 for file creation under sync directories
Track Dropbox shared folder acceptance events through endpoint telemetry
Alert on execution of high-risk file types (LNK, HTA, ISO, VBS, JS) originating from Dropbox sync paths

How to Mitigate CVE-2024-5924

Immediate Actions Required

Update Dropbox Desktop to a version newer than 198.4.7615 that addresses ZDI-CAN-23991
Restrict acceptance of shared folders to known, trusted Dropbox accounts only
Configure Microsoft Office to block macros in files from the Internet and enforce Protected View regardless of MOTW state

Patch Information

Dropbox addressed the vulnerability in releases following 198.4.7615. Refer to the Zero Day Initiative Advisory ZDI-24-677 and Dropbox release notes to confirm the fixed version. Apply the update across all endpoints running the Dropbox desktop client.

Workarounds

Disable automatic acceptance of shared folder invitations and require manual review
Apply Group Policy to enforce macro blocking and Protected View on all Office documents regardless of zone identifier
Use Attack Surface Reduction (ASR) rules to block Office applications from creating child processes

bash

# Configuration example: Windows Defender ASR rule to block Office child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled

# Group Policy registry to block macros from Internet-sourced files
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security" /v BlockContentExecutionFromInternet /t REG_DWORD /d 1 /f