CVE-2018-15667

Vulnerability

An issue was discovered in Bloop Airmail 3 version 3.5.9 for macOS. The application registers the airmail:// URL scheme and implements a send command that allows sending arbitrary emails from an active account without authentication. The handler has no restriction on who can invoke its functionality [1].

Exploitation

An attacker can exploit this by crafting a hyperlink or using any method that triggers the URL scheme, such as embedding the link in an email. When the victim clicks the link, the handler processes the send command automatically without prompting the user, resulting in the transmission of an attacker-crafted email from the target account [1].

Impact

Successful exploitation enables an attacker to send arbitrary emails from the victim's active Airmail account without consent, which could be used for information disclosure, phishing, or malware distribution.

Mitigation

As of the advisory, the vendor (Bloop) did not provide a response or fix [1]. Users should update to a patched version if available; otherwise, consider disabling or unregistering the airmail:// URL scheme or using an alternative email client.