Eclair patches a browser attack that could send commands to your Lightning node
Photo: CryptoSlate
Eclair, ACINQ's Bitcoin Lightning node software, released v0.14.4 on Oct. 15 to block malicious webpages from issuing authenticated node commands through an operator's browser. The exposure depends on an enabled Eclair API that the operator's browser can reach, with HTTP Basic authentication already cached in that browser. Eclair's node API can read node state, open and close channels, and send and receive payments. Eclair's v0.14.4 release notes explain how cached authentication lets a malicious webpage submit a plain HTML form to the node's API. The browser attaches the saved credentials automatically.
Source: CryptoSlate
