Is VirtualBox Legal?

VirtualBox and other similar products are legal. But you do have to have a legal copy of the OS, just as you would if you installed it on a physical computer.

There are 2 things to consider when it comes to virtualization. For one, the license of the virtualization software itself, like any other software, must allow you to run it in your environment, subjet to any limitations and term, pretty much like everything else.
In the particular case of VirtualBox, it's licensed under the GPLv2, which allows free, unrestricted usage of most functions. For further references look here: https://www.virtualbox.org/wiki/Licensing_FAQ

Then, there is the license of the software you want to run into the virtual machine, which would include at least an OS plus some other software, which must also be licensed to be run under that condition. For most programs, they make a distinction between a physical and virtual system, and count them as separate, even if they run within the same hardware. Free software of course gives that permission without too much trouble, but when it comes to proprietary software you typically need to purchase a second copy if you use it on both real and virtual systems.

For example, from the Windows 10 license: (emphasis mine)

a. License. The software is licensed, not sold. Under this agreement, we grant you the right to install and run one instance of the software on your device (the licensed device), for use by one person at a time, so long as you comply with all the terms of this agreement. Updating or upgrading from non-genuine software with software from Microsoft or authorized sources does not make your original version or the updated/upgraded version genuine, and in that situation, you do not have a license to use the software.

b. Device. In this agreement, “device” means a hardware system (whether physical or virtual) with an internal storage device capable of running the software. A hardware partition or blade is considered to be a device.

Which means that it can be run on a single "device", by a single person at once. Below it defines "device" as a hardware system but either physical or virtual. So, to run Windows 10 in this case, you need to buy one copy devoted to the virtual machine, plus maybe another if that's your host OS.

That still counts the virtual machine as a separate "computer", hence consumes the "one copy per computer" license (or another instance out of the 3 for the "family pack"). It's often reasonable to asume that virtual and physical systems are separate (even if the run on the same hardware) unless explictly stated otherwise.
Consider many software licenses were writen before virtualization became commonplace for home computers, hence make no distinction between the two. The Win10 that I put as an example is recent enough to take that into account and be more explicit.

That's the basis of the often cited phase "you need a separate license for the VM", and if both host and guest are Win7, you need in fact 2 licenses to activate them both.