An injection vulnerability in Klever-Go allows authenticated users to manipulate Elasticsearch indices, posing a high risk to data integrity and system availability.

The flaw exists in the indexer/common.go component, where attacker-controlled account names are included in Elasticsearch bulk requests without proper escaping. An authenticated user can supply specially crafted account names containing control characters to trigger unauthorized document creation, modification, or deletion within the indexing backend.

The ability to manipulate Elasticsearch indices via account name injection poses a significant threat to the integrity of blockchain indexing data. Successful exploitation could lead to data corruption, unauthorized overwrite of critical records, or denial of service for indexing operations. With a CVSS score of 8.4, this vulnerability is considered high severity due to its potential impact on data integrity and availability within the infrastructure.

Immediate Action: Update the Klever-Go implementation to version 1.7.20 or later to ensure proper input sanitization and escaping for account names.

Proactive Monitoring: Monitor Elasticsearch audit logs for unexpected bulk indexing operations or unauthorized modifications to indices that should only be managed by the indexer service.

Compensating Controls: If immediate patching is not feasible, restrict the permissions of the indexer service account within Elasticsearch to prevent it from performing unauthorized write or delete operations on sensitive indices.

Public Exploit Available: No

Organizations utilizing Klever-Go must prioritize upgrading to version 1.7.20 immediately. This vulnerability allows for significant index manipulation, and applying the vendor-provided patch is the only definitive way to resolve the underlying input validation failure. Failure to patch leaves the indexing infrastructure exposed to malicious data injection that could compromise the reliability of the entire blockchain monitoring environment.