CVE-2024-5924: a Mark-of-the-Web bypass in the Dropbox Windows app

Windows attaches a 'Mark of the Web' (MOTW) tag to files that originate from the internet. That tag is what triggers SmartScreen reputation checks and the 'this file came from another computer' protections, and what makes Office open risky documents in Protected View. CVE-2024-5924 describes a flaw in the Dropbox desktop application for Windows whereby files arriving through Dropbox sync could be written without the MOTW flag, effectively laundering an internet-sourced file into one Windows treats as local and trusted.

MOTW-bypass bugs are valuable to attackers because they neutralize a layer of defense that many phishing and malware-delivery chains depend on a victim ignoring. A shared Dropbox folder or link that silently delivered files without the warning could make a malicious document or installer look safer than it is. Public vulnerability trackers list the issue as addressed in current versions of the Dropbox client, so the practical fix is keeping the desktop app up to date.

The entry is included not because it was a mass-exploitation event, but because a serious record of Dropbox's problems should track the concrete, identifier-bearing security defects in its software — not only the headline breaches.