PT-2024-26111 · Lnbits · Lnbits

Fishcakeday + 1 · Published 2024-06-14 · Updated 2024-06-17 · CVE-2024-34694

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions LNbits versions prior to 0.12.6

Description Paying invoices in Eclair that do not get settled within the internal timeout (about 30s) can lead to a payment being considered failed, even though it may still be in flight. This issue can result in a total loss of funds for the node backend. The problem arises when using blocking: true on the API call, leading to a timeout error if a payment does not get settled within the 30s timeout.

Recommendations For versions prior to 0.12.6, update to version 0.12.6 to prevent loss of funds due to unsettled invoices. As a temporary workaround, consider checking the payment status after an error and always assume a payment is still in flight when unsure. Restricting the use of blocking: true on API calls until the issue is resolved can also help minimize the risk of exploitation.

Exploit

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

CVE-2024-34694

GHSA-3J4H-H3FP-VWWW

Affected Products

Lnbits

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34694.json · Exploit
• https://osv.dev/vulnerability/GHSA-3j4h-h3fp-vwww · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-34694 · Security Note
• https://osv.dev/vulnerability/CVE-2024-34694 · Vendor Advisory
• https://github.com/lnbits/lnbits/security/advisories/GHSA-3j4h-h3fp-vwww · Note
• https://github.com/lnbits/lnbits · Note
• https://twitter.com/CVEnew/status/1801673795444609406 · Twitter Post
• https://twitter.com/linuxpatch/status/1801647393248579680 · Twitter Post