Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured in config/node/api.yaml and registered by network/api/api.go does not require authentication. The first client message is parsed as a logger Profile in network/api/logs/logSender.go and applied process-wide through Profile.Apply, allowing a remote client to change global log levels and formatting options until the connection closes.
The same connection is registered as a log observer and can receive live process logs. An attacker can suppress normal logs, increase verbosity, distort operator visibility, and access operational information without credentials. This issue is fixed in version 1.7.20.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
Low
Partial data modification
Availability
Low
Partial disruption
CVSS Vector v3.1
Weakness Type (CWE)
References 4
https://github.com/klever-io/klever-go/commit/a2740c985a788fb69e17742ea4f0c37c4…
security-advisories@github.com
https://github.com/klever-io/klever-go/pull/74
security-advisories@github.com
https://github.com/klever-io/klever-go/releases/tag/v1.7.20
security-advisories@github.com
https://github.com/klever-io/klever-go/security/advisories/GHSA-9v8p-frvj-2pcm
security-advisories@github.com