I was reading about CVE-2018-20586 which allowed injection of arbitrary data into the debug log via an RPC in https://medium.com/@lukedashjr/cve-2018-20586-disclosure-ff3e1ab9a21f

One thing that I couldn't understand:

Valid authentication (username/password/cookie) for the RPC service is NOT required to exploit this vulnerability, only the ability to connect to the RPC port (which is by default only exposed to the local machine).

Does this ability to connect to RPC port without authentication still exist because I had to use basic auth last time I tried sending POST requests locally?


When it says, "connect" it is referring to connecting in the TCP/IP sense. The vulnerability simply required you having the ability to open a TCP/IP connection to bitcoind's RPC port, which is before any concept of authentication even comes into play.

It isn't that it was possible to send JSON-RPC commands to bitcoind without authentication (this was never possible). It's that the attack occurs before authentication takes place.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.