What's the "gadget vulnerability"?

user_87698 0
Viewed 6360

In a recent security advisory, Microsoft warns that "Vulnerabilities in Gadgets Could Allow Remote Code Execution":

An attacker who successfully exploited a Gadget vulnerability could run arbitrary code in the context of the current user.

(Microsoft Security Advisory 2719662)

I don't really understand the point. As far as I know, gadgets are (by design) HTML-based application running with full trust!

Full Trust

The choice to run a gadget is presented to the user in the same way that the choice to run any application downloaded from the Internet is presented. Information about the author of the gadget is displayed in a dialog box that indicates there is risk associated with this file. After the user accepts the warning, the gadget will run with all of the permissions associated with the user's login account.

(MSDN: Gadgets for Windows Sidebar Security)

For example, nothing prevents you from adding

<script language="VBScript"> 
    Set shell = CreateObject("Wscript.Shell")
    shell.Run "notepad.exe"
</script>

and executing arbitrary commands from your gadget. This works and it's by design.

Obviously, they can do everything that another application running in the local user's context can do. So, where is the vulnerability the MS Security Advisory is mentioning which "can be exploited"?

windows-desktop-gadgets security
5 Answers

Agreed, the Gadgets platform appears to be no more or less vulnerable than if the user executed an unsigned application.

Why the same system-level execution prevention, heuristic analysis & other methods applied to applications could not be applied to Gadgets is mystifying to me.

This smacks of laziness on the part of Microsoft: The Gadgets platform was not highly regarded or widely used (despite the potential of delivering an unprecedented level of capability and integration of web-features directly into the desktop), so rather than make any attempt whatsoever to safeguard the user from malicious Gadgets, they simply discontinued them.

With the direction the User Interfaces in Windows, Mac and Android are headed, the average user has less and less idea how an app (or plugin) actually does what it is doing, so the proliferation of needless, opportunistic or even malicious apps continues. I've been back and forth over the Gadgets specification, and as near as I can tell, it is no more insecure than the plugins system used by Chrome and FireFox.

Execution of ActiveX and Java within a Gadget is subject to the Security settings in Internet Explorer. If your security settings allow a Gadget to do something, most of those functions are exploitable within a plugin or Java app as well.

The analyst reports I've read indicate that these vulnerabilities have been patched in "most modern browsers" but that clearly isn't true of Internet Explorer, as every Gadget exploit I've seen can also be run within the IE browser.

In short it is the "toggle-switch" style handling of ActiveX, Java and other plugins which is at fault here. By trying to spare the user endless prompting and eliminating the requirement of making an informed decision, Microsoft continues to leave uninformed or careless users wide open to malicious web apps and plugins.

Trust certificates & security patches would have been vastly preferable to discontinuing the feature.

user_30532170
Related