Hackers Exploit Collabora CODE App Flaw to Backdoor Nextcloud Servers
Attackers have compromised Nextcloud servers by exploiting a critical vulnerability in the optional Collabora Online CODE app, planting web shells to gain arbitrary command execution.
A critical security vulnerability within the Collabora Online - Built-in CODE Server application, an optional component for Nextcloud instances, has been actively exploited by attackers to gain unauthorized access and establish backdoors. The flaw allows malicious actors to plant web shells on compromised servers, granting them the ability to execute arbitrary commands with the privileges of the web server process.
Three separate Nextcloud administrators reported the issue on GitHub, detailing the impact of the exploit. The earliest confirmed instance of exploitation was logged on September 10, indicating that the vulnerability has been in the wild for at least several weeks before wider public disclosure. A web shell is a script or program that can be uploaded to a web server and allows an attacker to execute commands remotely via HTTP requests, effectively turning the server into a compromised machine under their control.
The vulnerability specifically targets the Collabora Online CODE app, which provides rich text editing capabilities within Nextcloud. While not a core component of Nextcloud itself, its integration means that any Nextcloud instance utilizing this app is potentially at risk. The attackers leveraged the flaw to gain a persistent foothold, enabling further malicious activities such as data exfiltration, lateral movement within the network, or using the compromised server to launch further attacks.
Details regarding the exact technical mechanism of the vulnerability remain somewhat scarce in public disclosures, but the outcome is clear: successful exploitation leads to a complete compromise of the web server's context. This means attackers could potentially access and modify files, read sensitive configuration data, or even escalate privileges further if other misconfigurations exist on the server.
The implications for organizations using Nextcloud with the Collabora app are significant. A compromised server could lead to data breaches, service disruptions, and reputational damage. The ability to execute arbitrary commands means that attackers are not limited in their actions once inside, posing a severe threat to the integrity and confidentiality of the data hosted on the affected Nextcloud instance.
While the article does not specify a CVE identifier for this particular flaw, the nature of the attack—planting web shells and executing arbitrary commands—is a common indicator of severe vulnerabilities such as remote code execution (RCE) or command injection flaws. Administrators of Nextcloud instances that have the Collabora Online CODE app installed are strongly advised to review their security configurations and check for any signs of compromise.
Further investigation into the specific CVE and vendor advisories from Collabora and Nextcloud is crucial for understanding the full scope of the vulnerability and the available patches. The incident highlights the importance of regularly updating all components and plugins within a software ecosystem, as even optional add-ons can harbor critical security risks that attackers are eager to exploit.