ACINQ has released Eclair v0.14.4, a security patch for its Bitcoin Lightning Network node software. The headline change is that the node’s API now refuses requests coming from a web browser. Without it, a malicious web page visited by a node operator could send commands to the operator’s node. ACINQ “highly” recommends upgrading.
What changed
The release, published on 15 October, “contains security hardening fixes, most originating from @erickcestari and project Loupe”, ACINQ says. “We highly recommend upgrading, as some of these issues can be exploited by malicious nodes.” The project’s release notes credit project Loupe for most of the fixes.
The most visible change affects how operators can reach the node’s API. “The API now rejects requests that carry an Origin header, which means it cannot be used from a web browser anymore,” the notes say.
Why browsers were a risk
The notes explain the problem. Eclair’s API uses HTTP basic authentication, a simple username-and-password scheme that web browsers remember once entered and attach automatically to later requests, including requests triggered by other websites.
As a result, “any web page the node operator visits could then forge authenticated API calls”, ACINQ says. Because the API’s endpoints accept form-encoded parameters, “a plain HTML form is enough (the attacker cannot read the response, but the API call has already been made)”. This is a classic cross-site request forgery pattern: the attacker cannot see what the node sends back, but the command still runs with the operator’s credentials.
Browsers add an Origin header to such cross-site requests, while command-line tools such as curl and Eclair’s own eclair-cli never do. Rejecting any request that carries the header therefore shuts out browsers without affecting normal command-line use.
Who needs to do something
“Command-line usage is unaffected,” ACINQ says. Operators who were serving a web front-end that talks directly to the Eclair API will need to put “a back-end of your own in front of it”, so that requests reach the node from a server, not straight from a browser.
The upgrade is straightforward. ACINQ says the release “is fully compatible with previous eclair versions. You don’t need to close your channels, just stop eclair, upgrade and restart.”
ACINQ says Eclair builds are deterministic, so anyone can rebuild the release and check it matches. Operators can verify the release files against ACINQ’s signing key, E04E48E72C205463, which the notes say is available from ACINQ’s website and from a project committer’s GitHub account.
Other fixes
The changelog lists a series of further hardening changes, including:
- Rejecting seed files with an invalid length.
- Hardening interactive transaction funding “against a malicious bitcoind”, the Bitcoin node software Eclair relies on.
- Validating remote closing-script updates.
- Rejecting onion routing packets whose per-hop lengths exceed the packet.
- Rejecting splices that cannot be published, and bounding the fee rate of a peer’s replace-by-fee attempts when Eclair contributes funds.
ACINQ has not published severity ratings for the individual issues. It says some “can be exploited by malicious nodes”, but has not said that any were exploited in practice, and TSN has seen no reports of attacks.
Why it matters
Lightning nodes hold funds in payment channels and need to be online and reachable, which makes their control interfaces sensitive. Fixes found through outside review, such as those credited to project Loupe, are part of keeping that software safe, and ACINQ’s note that some issues could be exploited by malicious nodes is why it urges operators to upgrade.
What this means
- Eclair v0.14.4 makes the node API reject browser requests, closing a route by which a malicious website could forge authenticated commands using an operator’s cached login.
- Command-line users are unaffected. Operators with browser-based dashboards need their own back-end in front of the API.
- ACINQ recommends upgrading, which needs no channel closures. It has not reported any exploitation.
Sources
Related stories
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
