The Oct. 15 release blocks a cached-authentication route to Eclair's API and requires direct browser interfaces to add a backend.
Eclair, ACINQ's Bitcoin Lightning node software, released v0.14.4 on Oct. 15 to block malicious webpages from issuing authenticated node commands through an operator's browser.
The exposure depends on an enabled Eclair API that the operator's browser can reach, with HTTP Basic authentication already cached in that browser. Eclair's node API can read node state, open and close channels, and send and receive payments.
Eclair's v0.14.4 release notes explain how cached authentication lets a malicious webpage submit a plain HTML form to the node's API. The browser attaches the saved credentials automatically. The attacker cannot read the response, but the authenticated command still reaches the node.
The patch returns HTTP 403 before the API route runs whenever a request carries an Origin header, regardless of its value.
Thanks for signing up to The Catalyst. Look out for your first daily email. If you already receive it, you’re all set.
The restriction also affects legitimate browser interfaces, including those hosted at the same origin as the API. Those frontends now need an intermediary backend between the browser and Eclair.
Ordinary command-line access continues. The maintainers say curl and eclair-cli do not send the Origin header, so their normal API requests are unaffected.
Source link
