Eclair patches a browser attack that could send commands to your Lightning node

Eclair, ACINQ’s Bitcoin Lightning node software application, launched v0.14.4 on Oct. 15 to obstruct harmful websites from releasing validated node commands through an operator’s web browser.

The direct exposure depends upon a made it possible for Eclair API that the operator’s internet browser can reach, with HTTP Basic authentication currently cached because web browser. Eclair’s node API can check out node state, open and close channels, and send out and get payments.

Eclair’s v0.14.4 release notes describe how cached authentication lets a destructive web page send a plain HTML type to the node’s API. The internet browser connects the conserved qualifications immediately. The opponent can not check out the reaction, however the verified command still reaches the node.

Web browser user interfaces require a backend

The spot returns HTTP 403 before the API path runs whenever a demand brings an Origin header, despite its worth.

The constraint likewise impacts genuine web browser user interfaces, consisting of those hosted at the very same origin as the API. Those frontends now require an intermediary backend in between the internet browser and Eclair.

Common command-line gain access to continues. The maintainers state curl and eclair-cli do not send out the Origin header, so their typical API demands are untouched.

The Origin check still leaves authentication and network constraints necessary. A non-browser customer can leave out the header, so its lack does not develop that a demand is licensed. Eclair maintainer pm47 states the API ought to stay bound to loopback, limiting network access to the regional device.

The web browser repair combined on Sept. 15 in pull demand # 3380 and is consisted of in v0.14.4 along with the funding-fee and signer repair work CryptoSlate covered on Oct. 12.

Maintainers suggest updating and state operators can stop Eclair, set up the upgrade and reboot without closing their Lightning channels.

Short article context

Discussed in this short article