Security flaw allows unwanted code execution in Mailbox app
An Italian computer engineer has reportedly discovered that the popular Mailbox iOS app, which was acquired by Dropbox earlier this year, suffers from a potentially serious vulnerability that may allow malicious e-mails to wreak all sorts of havoc on your device. Macworld has confirmed that the flaw occurs in the latest version of Mailbox (1.6.2) currently available from the App Store.
The good news is that the problem is probably not as bad as it looks. The same issues that Spagnuolo highlights affect Safari itself, and were designed by Apple to provide some level of interoperability between Web pages and apps, like when an iTunes preview page automatically launches the App Store app.
Because iOS is tightly sandboxed, its security features are built with this functionality in mind and normally do not allow any potentially harmful operation to take place without the user’s permission (at least as long as the OS is running on a device that isn’t jailbroken). For example, just about any Web page can start a new SMS message, but the message can’t be sent without user intervention. That said, if Mailbox exposes some internal functionality through its webview, an attacker might manage to exploit it and steal private information, or possibly launch a third-party app that could perform unwanted actions.
Luckily, the folks behind Mailbox should be able to fix this problem very easily; most modern e-mail clients, including the built-in iOS Mail app and Google’s official Gmail software, for example, already filter HTML e-mails to prevent this kind of problem, and the techniques for doing so are well understood.
Mailbox representatives told Ars Technica that a fix for the issue is already in the works for a subsequent update of the app. Until then, however, it’s probably best to be extra-cautious when using the app—or, even better, switch to a different client to be on the safe side.