Eclair patches a browser attack that could send commands to your Lightning node

Eclair, ACINQ's Bitcoin Lightning node software, released v0.14.4 on Oct. 15 to block malicious webpages from issuing authenticated node commands through an operator's browser.

The exposure depends on an enabled Eclair API that the operator's browser can reach, with HTTP Basic authentication already cached in that browser. Eclair's node API can read node state, open and close channels, and send and receive payments.

Eclair's v0.14.4 release notes explain how cached authentication lets a malicious webpage submit a plain HTML form to the node's API. The browser attaches the saved credentials automatically. The attacker cannot read the response, but the authenticated command still reaches the node.

Browser interfaces need a backend

The patch returns HTTP 403 before the API route runs whenever a request carries an Origin header, regardless of its value.

The restriction also affects legitimate browser interfaces, including those hosted at the same origin as the API. Those frontends now need an intermediary backend between the browser and Eclair.

Ordinary command-line access continues. The maintainers say curl and eclair-cli do not send the Origin header, so their normal API requests are unaffected.

The Origin check still leaves authentication and network restrictions essential. A non-browser client can omit the header, so its absence does not establish that a request is authorized. Eclair maintainer pm47 says the API should remain bound to loopback, restricting network access to the local machine.

The browser fix merged on Sept. 15 in pull request #3380 and is included in v0.14.4 alongside the funding-fee and signer repairs CryptoSlate covered on Oct. 12.

Maintainers recommend upgrading and say operators can stop Eclair, install the update and restart without closing their Lightning channels.