Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App
Summary
Attackers have exploited a critical vulnerability in the Collabora Online - Built-in CODE Server app, an optional component for Nextcloud, to gain unauthorized access and install web shells on affected servers. The first reported attack occurred on September 10th, and the vulnerability allows attackers to execute commands with the privileges of the web server account.
IFF Assessment
This vulnerability allows attackers to compromise servers, which is bad news for defenders.
Severity
The vulnerability allows remote code execution and can be exploited without authentication, potentially leading to complete system compromise. The high CVSS score reflects the severity of unauthorized access and control attackers can achieve.
Defender Context
Defenders should immediately check if their Nextcloud instances are using the Collabora Online - Built-in CODE Server app and ensure it is updated to the patched version. This incident highlights the importance of securing optional add-on components and monitoring for unauthorized web shell installations, which can be a precursor to further compromise.