đŸ”´ Critical: Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App
-
Attackers have been exploiting a vulnerability in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers and backdoor them. At least three administrators reported the issue on GitHub, with the earliest logged attack dating to September 10.
A web shell is a small file that lets an attacker execute arbitrary commands through web requests, running with the privileges of the web server account. Once dropped, it gives the intruder a persistent foothold on the host.
Key points so far:
- Affected component: the Collabora Online - Built-in CODE Server app, which is optional rather than part of a default Nextcloud install.
- Impact: remote attackers can deploy web shells, leading to command execution on the server.
- Reporting: the first reports came from three administrators on GitHub; the initial observed attack occurred on September 10.
- No specific CVE ID or patch identifier has been provided in the source reporting at this time.
Administrators running the Built-in CODE Server app should review their Nextcloud instances for unexpected files, check web server logs for suspicious requests, and consider disabling the app if it is not required until more details emerge. Because the reports are still developing, watch the official Nextcloud and Collabora channels for updates rather than relying on unofficial advisories.
Source: The Hacker News
Are you running the Collabora Built-in CODE Server app in your environment, and if so, have you checked it for signs of compromise?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better đŸ’—
Register Login