Eclair patches a browser attack that could send commands to your Lightning node

Eclair, ACINQ's Bitcoin Lightning node software, released v0.14.4 on Oct. 15 to block malicious webpages from issuing authenticated node commands through an operator's browser.The exposure depends on an enabled Eclair API that the operator's browser can reach, with HTTP Basic authentication already cached in that browser. Eclair's node API can read node state, open and close channels, and send and receive payments.Eclair's v0.14.4 release notes explain how cached authentication lets a malicious webpage submit a plain HTML form to the node's API. The browser attaches the saved credentials automatically. The attacker cannot read the response, but the authenticated command still reaches the node.Browser interfaces need a backendThe patch returns HTTP 403 before the API route runs whenever a request carries an Origin header, regardless of its value.The restriction also affects legitimate browser interfaces, including those hosted at the same origin as the API. Those frontends now need an intermediary backend between the browser and Eclair.Ordinary command-line access continues. The maintainers say curl and eclair-cli do not send the Origin header, so their normal API requests are unaff...