Dropbox Desktop Folder Sharing Mark-of-the-Web Bypass Vulnerability

CVE-2024-5924

What is CVE-2024-5924?

This vulnerability impacts the Dropbox Desktop application, specifically affecting the handling of shared folders. When syncing files from a shared folder linked to an untrusted account, the app fails to correctly apply the Mark-of-the-Web security feature to the downloaded files. As a result, this oversight enables an attacker to execute arbitrary code within the context of the current user, provided they can trick the user into visiting a malicious webpage or downloading a harmful file. It is essential for users to be aware of the risks associated with untrusted accounts and the potential for exploitation through this vulnerability.

References