title: What's the "gadget vulnerability"?
body: <p>In a recent security advisory, Microsoft warns that "<em>Vulnerabilities in Gadgets Could Allow Remote Code Execution</em>":</p>
  
  <blockquote>
    <p>An attacker who successfully exploited a Gadget vulnerability could run arbitrary code in the context of the current user.</p>
  </blockquote>
  
  <p>(<a href="http://technet.microsoft.com/en-us/security/advisory/2719662" rel="noreferrer">Microsoft Security Advisory 2719662</a>)</p>
  
  <hr>
  
  <p>I don't really understand the point. As far as I know, gadgets are (by design) HTML-based application running with full trust!</p>
  
  <blockquote>
    <p><strong>Full Trust</strong></p>
    
    <p>The choice to run a gadget is presented to the user in the same way that the choice to run any application downloaded from the Internet is presented. Information about the author of the gadget is displayed in a dialog box that indicates there is risk associated with this file. After the user accepts the warning, the gadget will run with all of the permissions associated with the user's login account.</p>
  </blockquote>
  
  <p>(<a href="http://msdn.microsoft.com/en-us/library/windows/desktop/ff486358.aspx#_sidebar_overview_fulltrust" rel="noreferrer">MSDN: Gadgets for Windows Sidebar Security</a>)</p>
  
  <p>For example, nothing prevents you from adding</p>
  
  <pre><code>&lt;script language="VBScript"&gt; 
      Set shell = CreateObject("Wscript.Shell")
      shell.Run "notepad.exe"
  &lt;/script&gt; 
  </code></pre>
  
  <p>and executing arbitrary commands from your gadget. <a href="http://blogs.technet.com/b/heyscriptingguy/archive/2005/10/31/how-can-i-start-an-application-from-an-hta.aspx" rel="noreferrer">This works and it's by design.</a></p>
  
  <p>Obviously, they can do everything that another application running in the local user's context can do. So, where is the <em>vulnerability</em> the MS Security Advisory is mentioning which "can be exploited"?</p>