What's the "gadget vulnerability"?

Question

In a recent security advisory, Microsoft warns that "Vulnerabilities in Gadgets Could Allow Remote Code Execution":

An attacker who successfully exploited a Gadget vulnerability could run arbitrary code in the context of the current user.

(Microsoft Security Advisory 2719662)

---

I don't really understand the point. As far as I know, gadgets are (by design) HTML-based application running with full trust!

Full Trust

The choice to run a gadget is presented to the user in the same way that the choice to run any application downloaded from the Internet is presented. Information about the author of the gadget is displayed in a dialog box that indicates there is risk associated with this file. After the user accepts the warning, the gadget will run with all of the permissions associated with the user's login account.

(MSDN: Gadgets for Windows Sidebar Security)

For example, nothing prevents you from adding

<script language="VBScript"> 
    Set shell = CreateObject("Wscript.Shell")
    shell.Run "notepad.exe"
</script> 

and executing arbitrary commands from your gadget. This works and it's by design.

Obviously, they can do everything that another application running in the local user's context can do. So, where is the vulnerability the MS Security Advisory is mentioning which "can be exploited"?

Answer 1

Well the "gadget vulnerability" is the problem that:

the risks that gadgets are exposed to are the same as those faced by any web-based application, e.g. Man-In-The-Middle or code injection. Similar issues existed in earlier versions of most web browsers but modern browsers have specifically implemented controls to attempt to mitigate many of these issues. These controls have not been implemented in the Gadgets platform, leaving them vulnerable to well-known and thoroughly discussed attacks.
- We have you by the gadgets, black hat.

so you can see the main exploit is that there were no controls to limit the gadgets from running code with no restraint.

Another problem:

Microsoft has said that it has discovered that some Vista and Win7 gadgets don’t adhere to secure coding practices and should be regarded as causing risk to the systems on which they’re run.

so indeed running arbitrary code is part of HTA's but because the sidebar and gadgets platform didn't mitigate it and were quite pessimistic, thinking that all gadget programmers would write safe code and wouldn't try to exploit or do things gadgets aren't suppose to do.

Hope it answered what you asked.

I still think the question is quite vague because you say: well they allow to run arbitrary code and it's part of the model and concept and they didn't mitigate it so what's the exploit? it's already exploited... - this is the whole idea :)

It can be asked about every flaw and attack and that's exactly the problem - it was by design a problem and wasn't secure it was discovered that since no mitigation and since you are really able to run and execute the malicious code with no problem these gadgets have a flaw.