NIS shutdown

General Discussion
#1

Hi.
Today I discovered that the request to url _http://127.0.0.1:7890/shutdown causes my NIS to stop without warning. Moreover, the similar request causes stop of the remote NIS on the specified IP address. Thus, anyone can remotely shutdown any public NIS server in the NEM network.
Is this a bug or a feature?

#2

I just noticed my NIS shut down suddenly. Came here to check.

this is severe.

seems like almost most nodes are now shutdown already
see nodeexplorer: http://nodeexplorer.com/

#3

devs?

#4

lol some attacker/script shut(s) the entire network down, this is what I got in my logs:

INFO NEM Infrastructure Server 0.6.25-BETA shutdown… (org.nem.core.deploy.CommonStarter main)

I didnt initiate this. /shutdown did.

#5

lol nice bug  :slight_smile:

#6

dumb bug  :-[

We've used @ClientApi instead of @TrustedApi on /shutdown

Preparing security fix right now.

#7

http://bob.nem.ninja/nis-ncc-0.6.26.zip. New fi released. Thanks Gimre.

#8

thx for quick reaction gimre :wink:

#9

https://forum.ournem.com/technical-discussion/nem-beta-0-6-26-security-update/