BTCPay Server leaks LND macaroon credential files
Funds were actually stolen from a bitcoin payment server!
Summary
An unauthenticated remote attacker can retrieve LND node .macaroon credential files, take control of the node and move its funds. Every version before 2.4.2, including 2.4.2 release candidates, is affected, and the advisory confirms attacks and stolen funds.
Affected when
- LND node used with BTCPay Server
What to do
Update BTCPay Server to 2.4.2 and LND to 0.21.1 immediately. If you cannot, take the server offline, and rotate credentials if LND was reachable through any route you manage separately. Also check your LND node for unfamiliar activity.
Products and platforms
CVE IDs
Sources
- Advisory: blog.btcpayserver.org (opens in a new tab)
- Write-up: binance.com (opens in a new tab) · vulncheck.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen