In klever-go versions before 1.7.20, the function serializing data for updating accounts inserts the attacker-controlled acc.Name value into Elasticsearch bulk JSON and NDJSON requests without proper escaping. Since the SetAccountName transaction accepts UTF-8 account names with special characters (quotes, backslashes, newlines), these characters can break the JSON structure, causing rejection of bulk batches or injection of additional bulk actions that can create, overwrite, or delete documents in indices writable by the indexer. The vulnerability is persistent because the manipulated state is replayed by new or historical indexers. Exploitation does not require direct access to the Elasticsearch service or the indexing host. The vulnerability is addressed in klever-go version 1.7.20.

An attacker can craft account names that break JSON serialization in Elasticsearch bulk requests, potentially causing denial of service by rejecting bulk batches or enabling injection of additional bulk actions that manipulate Elasticsearch documents. This can lead to unauthorized creation, modification, or deletion of documents in indices writable by the indexer. The vulnerability affects persistent state and can be triggered without direct access to the Elasticsearch service or indexing host, increasing the attack surface.

Upgrade klever-go to version 1.7.20 or later, where this issue is fixed by properly escaping account names in Elasticsearch bulk requests. No additional mitigation is required if the upgrade is applied.