Eclair patches a browser attack that could send commands to your Lightning node

Eclair, ACINQ's Bitcoin Lightning node software, released v0.14.4 on Oct. 15 to block malicious webpages from issuing authenticated node commands through an operator's browser. The exposure depends on an enabled Eclair API that the operator's browser can reach, with HTTP Basic authentication already cached in that browser. Eclair's node API can read node state, open and close channels, and send and receive payments. Eclair's v0.14.4 release notes explain how cached authentication lets a malicious webpage submit a plain HTML form to the node's API. The browser attaches the saved credentials automatically. The attacker cannot read the response, but the authenticated command still reaches the node. The patch returns HTTP 403 before the API route runs whenever a request carries an Origin header, regardless of its value.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to CryptoSlate.