Insecure Download Vulnerability in Powerlevel10k gitstatus Component

Powerlevel10k, a popular theme for the Zsh shell, contains a critical vulnerability in its gitstatus/install script affecting versions up to 1.20.0. The installation process for the gitstatus component utilizes curl -k to download binaries, effectively disabling TLS certificate validation. Furthermore, the script skips essential integrity checks if the sha256sum utility is not present on the system. These design flaws allow a network-positioned attacker to perform a man-in-the-middle (MitM) attack, intercepting the request to the download mirror and substituting a malicious archive. Once the script completes, the malicious binary is executed as the gitstatusd daemon with the privileges of the user who initiated the shell session. Given that gitstatusd is invoked on every shell prompt, this results in persistent, unauthorized code execution within the user's environment.

Attack Chain

1. Attacker establishes a network-positioned vantage point between the victim and the download mirror.
2. Victim executes a command triggering the gitstatus/install script, such as initializing or updating the shell theme.
3. Attacker intercepts the HTTPS request initiated by the insecure curl -k command.
4. Attacker returns a malicious binary archive instead of the legitimate gitstatusd component.
5. The script extracts the malicious binary to the local filesystem without performing integrity validation.
6. The shell theme executes the malicious file, establishing it as the persistent gitstatusd daemon.
7. Every time the victim opens a terminal or executes a command, gitstatusd runs malicious code under the user's account.

Impact

Successful exploitation results in arbitrary code execution under the privileges of the victim's user account. This impact is persistent across terminal sessions, potentially leading to full account compromise, credential theft, and lateral movement within the environment. This vulnerability affects any environment utilizing Powerlevel10k versions 1.20.0 or older, including developer workstations and server environments configured with this theme.

Recommendation

1. Upgrade Powerlevel10k to a version beyond 1.20.0 immediately.
2. Audit user home directories for the existence of gitstatusd binaries that do not match known cryptographic hashes.
3. Ensure that sha256sum or equivalent integrity verification utilities are installed and functional on all systems to prevent fallback to insecure installation modes.
4. Restrict outgoing network connections from servers and workstations to prevent unauthorized communication with unknown download mirrors.