Powerlevel10k Insecure Temp Directory in gitstatus/install Script

Executive Summary

Powerlevel10k before version 1.20.19 has an insecure temporary directory vulnerability in the gitstatus/install script. When the mktemp command fails, the script reuses attacker-creatable directories. Attackers can pre-create a predictable directory named gitstatus-install.tmp to replace the extracted gitstatusd binary. When the victim runs the installer, the malicious binary executes with the victim's privileges, leading to potential unauthorized access or code execution.

Useful 0 Not Useful 0

Detection Guidance

Check for the presence of the predictable temporary directory 'gitstatus-install.tmp' in your system. Use commands like 'find / -name gitstatus-install.tmp 2>/dev/null' to locate it. Also inspect the gitstatus/install script for the vulnerable pattern where 'mkdir -p' is used without prior cleanup.

Useful 0 Not Useful 0

Impact Analysis

Local attackers could gain unauthorized access to your system or execute arbitrary code with your privileges. This could lead to data theft, system compromise, or further network infiltration if the attacker gains elevated permissions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily affects local system integrity and privilege escalation rather than direct data exposure. It does not inherently violate GDPR or HIPAA unless exploited to access, modify, or exfiltrate regulated data. Compliance impact depends on whether the attacker gains unauthorized access to sensitive information or systems covered by these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update Powerlevel10k to version 1.20.19 or later. Remove any existing 'gitstatus-install.tmp' directory manually. Review the gitstatus/install script to ensure it uses 'rm -rf' before 'mkdir' for temporary directory creation.

Useful 0 Not Useful 0