Hackers exploit Collabora CODE flaw to backdoor Nextcloud servers
The bug was already being used before the advisory and CVE were published, leaving some administrators exposed while there was still no public warning to key on.
Attackers have been using a critical command-injection bug in Collabora Online’s built-in CODE server for Nextcloud to plant web shells on exposed servers, and the flaw matters because it can be hit without user interaction once the embedded server is stopped. The issue affects richdocumentscode versions before 26.4.303, but not standalone Collabora Online, Docker or RPM/DEB installs, or Nextcloud All-in-One deployments. Reports say activity started around September 10, before the CVE and advisory landed on October 14, which left administrators with a working exploit but no easy identifier to track. Collabora says the patch was committed on September 9 and shipped in 26.4.303 on September 11, while Nextcloud says the delayed disclosure was meant to give users time to update.
Why it matters
For Nextcloud users running the built-in CODE server, the issue turns a server component into a route for web shells if it is exposed and stopped. The delayed disclosure means defenders had to act before there was an advisory or CVE to anchor detection, while users on standalone Collabora Online, Docker or RPM/DEB installs, and Nextcloud All-in-One were not affected.
Keep or strike?
Does this story matter, or is it hype? Mark it before you see what everyone else did.
Sources
- BleepingComputer