fix(lightning): block SSRF path traversal in LNURL endpoints (BUG-1209)#3862
Open
davidleomay wants to merge 3 commits into
Open
fix(lightning): block SSRF path traversal in LNURL endpoints (BUG-1209)#3862davidleomay wants to merge 3 commits into
davidleomay wants to merge 3 commits into
Conversation
…UG-1209) Validate link IDs in LightningClient to reject path traversal via double-encoded slashes. Add admin endpoint to rotate webhook secrets.
…3869) The Agent reuse refactoring dropped the CA-validated httpsAgent from httpLnBitsConfig, so LNbits requests are verified against system CAs only. In production LNbits serves the self-signed LND certificate, which makes every LNbits call fail TLS verification. Reuse one shared CA-validated agent for both LND and LNbits requests.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
LightningClientwith^[\w-]+$regex to block path traversal via double-encoded slashes (%252f) in all LNURL forwarding endpoints (lnurlp, lnurlw, lnurld)POST /admin/lightning/rotate-webhook-secretsto rotate all LNbits deposit webhook signing secrets (reuses existingDepositService.updateLightningDepositWebhook())Context
BUG-1209 (CVSS 9.1): unauthenticated SSRF in
GET /v1/lnurlp/:idallowed reading the full LNbits deposit-link inventory (~2100 records) including webhook signing secrets, by double-encoding slashes to traverse to/api/v1/links. Leaked secrets could be replayed against the deposit-confirmation endpoint.Fixes report recommendations 2 (encoding), 3 (whitelist), and 4 (rotate signatures). Recommendation 1 (rebuild instead of passthrough) deferred as architectural follow-up.
Action items after merge
signingPrivKey/signingPubKey) in environment configPOST /admin/lightning/rotate-webhook-secretsto re-sign all deposit links with the new keypairdeposit_daf9f78d63497505, ~2026-06-06 19:15 UTC)Test plan
ABC123) and payment link IDs (pl_xxx,plp_xxx) still work in staging%252f-based traversal returns 400 instead of proxying to LNbits