An Italian computer engineer has reportedly discovered that the popular Mailbox iOS app, which was acquired by Dropbox earlier this year, suffers from a potentially serious vulnerability that may allow malicious e-mails to wreak all sorts of havoc on your device. Macworld has confirmed that the flaw occurs in the latest version of Mailbox (1.6.2) currently available from the App Store.
According to Novara-based Michele Spagnuolo, the flaw allows JavaScript code to be embedded and executed from inside an HTML message; because Mailbox doesn't filter the data stored in the messages it displays, the code can be executed without any user intervention whatsoever. As Spagnuolo shows in a short video he shot for the occasion, this means that simply opening an e-mail message could cause a different app to be launched, and could allow third parties to foil "advanced spam techniques, tracking of user actions, hijacking the user by just opening an email, and, [...] potentially much worse things" on unsuspecting users.
The root cause of the problem is likely the fact that Mailbox uses a special Apple-provided control, called a webview, to render HTML messages. Since webviews are essentially self-contained versions of Safari, they also inherit all of the browser's capabilities--including support for executing JavaScript code.
The good news is that the problem is probably not as bad as it looks. The same issues that Spagnuolo highlights affect Safari itself, and were designed by Apple to provide some level of interoperability between Web pages and apps, like when an iTunes preview page automatically launches the App Store app.
Because iOS is tightly sandboxed, its security features are built with this functionality in mind and normally do not allow any potentially harmful operation to take place without the user's permission (at least as long as the OS is running on a device that isn't jailbroken). For example, just about any Web page can start a new SMS message, but the message can't be sent without user intervention. That said, if Mailbox exposes some internal functionality through its webview, an attacker might manage to exploit it and steal private information, or possibly launch a third-party app that could perform unwanted actions.
Luckily, the folks behind Mailbox should be able to fix this problem very easily; most modern e-mail clients, including the built-in iOS Mail app and Google's official Gmail software, for example, already filter HTML e-mails to prevent this kind of problem, and the techniques for doing so are well understood.
Mailbox representatives told Ars Technica that a fix for the issue is already in the works for a subsequent update of the app. Until then, however, it's probably best to be extra-cautious when using the app--or, even better, switch to a different client to be on the safe side.