CyberRota Analysis
AI-GeneratedThe Klever-Go implementation of the Klever blockchain protocol prior to version 1.7.20 contains a critical vulnerability in its default-open WebSocket route, which lacks authentication. This flaw allows remote attackers to manipulate global log levels, suppress normal logs, and access sensitive operational information without any credentials. Organizations using affected versions should prioritize upgrading to version 1.7.20 to mitigate the risk of unauthorized access and operational disruption.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured in config/node/api.yaml and registered by network/api/api.go does not require authentication. The first client message is parsed as a logger Profile in network/api/logs/logSender.go and applied process-wide through Profile.Apply, allowing a remote client to change global log levels and formatting options until the connection closes. The same connection is registered as a log observer and can receive live process logs. An attacker can suppress normal logs, increase verbosity, distort operator visibility, and access operational information without credentials. This issue is fixed in version 1.7.20.