Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS0zajRoLWgzZnAtdnd3d84AA9Il
LNbits improperly handles potential network and payment failures when using Eclair backend
Summary
Paying invoices in Eclair that do not get settled within the internal timeout (about 30s) lead to a payment being considered failed, even though it may still be in flight.
Details
Using blocking: true
on the API call will lead to a timeout error if a payment does not get settled in the 30s timeout with the error: Ask timed out on [Actor[akka://eclair-node/user/$l#134241942]] after [30000 ms]. Message of type [fr.acinq.eclair.payment.send.PaymentInitiator$SendPaymentToNode]. A typical reason for AskTimeoutException is that the recipient actor didn't send a reply.
https://github.com/lnbits/lnbits/blob/c04c13b2f8cfbb625571a07dfddeb65ea6df8dac/lnbits/wallets/eclair.py#L138
This is considered a payment failure by parts of the code, and assumes the payment is not going to be settled after:
https://github.com/lnbits/lnbits/blob/c04c13b2f8cfbb625571a07dfddeb65ea6df8dac/lnbits/wallets/eclair.py#L144
https://github.com/lnbits/lnbits/blob/c04c13b2f8cfbb625571a07dfddeb65ea6df8dac/lnbits/wallets/eclair.py#L141
https://github.com/lnbits/lnbits/blob/c04c13b2f8cfbb625571a07dfddeb65ea6df8dac/lnbits/wallets/eclair.py#L146
The best way to fix this is to check the payment status after an error, and when not sure, always consider a payment still in flight.
PoC
A very simple way to exploit this is:
- Create a hold invoice
- Pay the invoice with the LNbits server backed by an Eclair node, until it times out
- Settle the hold invoice
Impact
This vulnerability can lead to a total loss of funds for the node backend.
Permalink: https://github.com/advisories/GHSA-3j4h-h3fp-vwwwJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zajRoLWgzZnAtdnd3d84AA9Il
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 3 months ago
Updated: 3 months ago
CVSS Score: 8.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Identifiers: GHSA-3j4h-h3fp-vwww, CVE-2024-34694
References:
- https://github.com/lnbits/lnbits/security/advisories/GHSA-3j4h-h3fp-vwww
- https://nvd.nist.gov/vuln/detail/CVE-2024-34694
- https://github.com/advisories/GHSA-3j4h-h3fp-vwww
Blast Radius: 1.0
Affected Packages
pypi:lnbits
Dependent packages: 1Dependent repositories: 0
Downloads: 627 last month
Affected Version Ranges: < 0.12.6
Fixed in: 0.12.6
All affected versions: 0.10.3
All unaffected versions: 0.12.6, 0.12.7, 0.12.8, 0.12.9, 0.12.10, 0.12.11