Eclair patches browser attack that could send commands to Lightning nodes
- —Patch returns HTTP 403 for any request with an Origin header before the API route executes
- —Exposure required an enabled API reachable by the browser with cached HTTP Basic credentials
- —Legitimate browser frontends now need an intermediary backend between browser and Eclair
- —curl and eclair-cli do not send the Origin header, so their requests are unaffected
Why it matters: The flaw let a malicious page open channels and send payments from a node; operators should upgrade and keep the API bound to loopback.
Source: CryptoSlate