Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataForUpdateAccounts places the attacker-controlled acc.Name value into an Elasticsearch _bulk JSON a…