CVE-2024-5924 is a Mark-of-the-Web bypass in Dropbox Desktop with a CVSS score of 8.8 (High). Files synced from a shared folder owned by an untrusted account do not get the web-origin marker. No patched version is named in the advisory, so limit what you accept from outside accounts.
What's affected
The NVD record lists Dropbox Desktop 198.4.7615 and describes a flaw in the handling of shared folders. When files sync from a shared folder belonging to an untrusted account, the desktop app does not apply the Mark-of-the-Web to the local files. The weakness is CWE-693, protection mechanism failure. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, so a user has to take an action such as opening a file.
The Zero Day Initiative advisory ZDI-24-677 says Dropbox acknowledged the report on 6 June 2024 and on 10 June said Mark-of-the-Web issues are out of scope for its bug bounty. ZDI published it as a zero-day on 13 June 2024. The advisory names no fixed version. Its only mitigation is to restrict interaction with the application.
NVD and ZDI do not disagree on severity here. I found no statement that the issue is exploited, and the record does not flag it as known exploited.
How to check if you're exposed
The Mark-of-the-Web is a Windows marker stored with a file that says it came from the internet. Windows uses it to show warnings and to apply protections to files from untrusted sources. To see whether it is present on a file, in PowerShell:
Get-Item -Path .\example.docx -Stream Zone.Identifier
If a file synced from an external shared folder has no Zone.Identifier stream, the marker was not applied. Also list the shared folders on managed machines and note which are owned by accounts outside your organization.
What to do now
- Find Dropbox Desktop installs and note the version, then check the vendor release notes for a build that addresses this. I could not confirm one.
- Decline or remove shared folders from accounts you do not know and trust.
- Tell staff not to open files from external shared folders without scanning them first.
- Keep endpoint protection that scans files on access, since the usual Windows prompt may not appear for these files.
- Consider a policy that blocks syncing of folders shared from outside accounts, if your plan allows it.
Why it matters
Mark-of-the-Web is a quiet defense. Many Windows protections, such as warnings on downloaded documents, depend on it being present. When a sync client forgets to apply it, the files look local and trusted even though they came from a stranger.
The record needs a user to act, so this is not a worm. It is a way to weaken a safeguard that people rely on without thinking. Because the vendor treated it as out of scope, plan around the behavior rather than waiting for a fix.
Quick check
Is there a patched version of Dropbox Desktop?
The advisory names none. Check the vendor release notes for any newer build.
Does the bypass run code by itself?
No. Per the record a user must open a file or visit a page, and the issue is the missing protection on those files.
Sources
- ZDI-24-677
- NVD record for CVE-2024-5924
- Gold entry
Last reviewed: 19 October 2026.
