Hackers Exploit Collabora RCE Flaw to Backdoor Nextcloud Servers
Hackers exploit Collabora RCE flaw in Nextcloud servers, affecting built-in CODE server app. Upgrades to version 26.4.303 or removal of the server app recommended.
Intelligence analysis by Qwen 2.5 (3B)
Hackers have exploited a critical command execution flaw in Nextcloud's built-in Collabora server app, leading to security concerns and recommendations for upgrades or removal of the app.
Hackers found a way to trick a special app in Nextcloud servers into running bad commands. They used this to look for passwords and other sensitive information. Nextcloud told people to update their servers to fix the problem.
Analysis
Collabora RCE Flaw Details
The Collabora RCE flaw impacts richdocumentscode versions before 26.4.303, affecting only the built-in CODE server app in Nextcloud. The flaw allows attackers to inject OS commands via a malicious request to the app's proxy.php endpoint.
Attack Vector
Attackers exploit the flaw by sending a malicious request to the app's proxy.php endpoint, triggering OS command injection. The key prerequisite for successful exploitation is stopping the built-in CODE server.
Impact
Multiple administrator reports indicate attacks began in mid-September, with reports of malicious activity against multiple endpoints dating back to September 10. The attackers used PHP webshells to search for password databases, password manager artifacts, and cryptocurrency wallets.
Vendor Response
Collabora reported the vulnerability in mid-September and released an update to version 26.4.303 on September 11. The advisory and CVE were published on October 14, a gap of more than four weeks. The vendor justified the disclosure delay by giving users time to update and not observing widespread exploitation.
Security Community Response
The community response was swift, with a community warning published on October 3, urging administrators to update immediately. However, the lack of a CVE ID made it more difficult for administrators to pinpoint the issue correctly and implement efficient defenses.
AI-Driven Vulnerability Discovery
A study from cybersecurity company Second Security illustrates the gap between security fixes and formal vulnerability notifications. The median interval between public fixes and CVE publication was 39 days in August, up from 5.1 days in January. The researchers suggest that growing volumes of AI-assisted vulnerability discoveries are straining CVE processing and contributing to publication delays.
Nextcloud's Perspective
Nextcloud responded to the malicious activity reports, stating that Collabora reported the vulnerability in mid-September and that an update became available through the app store. The company justified the disclosure delay by giving users time to update and not observing widespread exploitation. The company attributed the delayed announcement primarily to GitHub CVE-processing backlogs, which it said were under strain from increasing volumes of AI-driven security reports.
Key points
- Collabora RCE flaw impacts richdocumentscode versions before 26.4.303
- Attackers use malicious requests to trigger OS command injection
- Updates to version 26.4.303 or removal of the server app recommended
- Lack of CVE ID makes it harder for administrators to pinpoint the issue
- Growing volumes of AI-assisted vulnerability discoveries may contribute to publication delays
The delay in issuing a CVE and the lack of a CVE ID may have slowed down the response time, but the community and vendors are working to address the issue and prevent future attacks.
If the delay in issuing a CVE and the lack of a CVE ID continue, it could lead to more security issues being overlooked, as they may not be immediately recognized as related to the Collabora RCE flaw.
