Eclair v0.14.4 released to block browser attacks on Lightning nodes

Eclair, ACINQ's Bitcoin Lightning node software, released version 0.14.4 on Oct. 15 to prevent malicious webpages from issuing commands to an operator's node through their browser. The vulnerability arises from an enabled Eclair API accessible via the browser, with cached HTTP Basic authentication. This allows a malicious webpage to submit a plain HTML form to the node's API, automatically attaching saved credentials. Although the attacker cannot read the response, the command still reaches the node. The update introduces an HTTP 403 response for requests with an Origin header, affecting both malicious and legitimate browser interfaces. These interfaces now require an intermediary backend to communicate with Eclair. Command-line access remains unaffected as tools like curl and eclair-cli do not send the Origin header. The update emphasizes the importance of authentication and network restrictions, as non-browser clients can omit the header. The browser fix was merged on Sept. 15 and included in v0.14.4, which also addresses funding-fee and signer issues. Operators are advised to upgrade without closing their Lightning channels.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.