There seems to be no easy way to do this. Tried Dropbox--you get files attached, but they only contain a bunch of HTML with references to the Dropbox URL. Jira Support says this is because login credentials cannot be provided by the importer. In fact, this is a severe limitation of the importer. Because of this, I can't use SharePoint either--we can never access SharePoint without credentials. Why would anyone have a public site without security to put their files in? They also suggest an open server that doesn't need login credentials. No can do. Support suggested I use RESTful API, which is a whole new can of worms.
We converted from another ALM tool, not a very common one, and using the CSV importer, combined with some direct access to the old tool's database, and VB.net code, have been able to import everything we want--except attachments.
There should be many users that have worked on this issue. How did you end up doing it? Besides REST API? What about those Dropbox-Jira integration plugins?