Hackers exploit Collabora flaw to backdoor Nextcloud servers

[RicFlair04]

Attackers are exploiting a critical flaw in an optional Collabora Online component for Nextcloud, the popular self hosted file sharing platform. BleepingComputer reports that the bug affects the built in CODE Server app before version 26.4.303. It allows a malicious request to run operating system commands without any login or user interaction

There is a specific condition. The attack works when the built in server is stopped, for example after a restart or a crash. Attackers have used it to plant PHP web shells, giving them ongoing access, and to search for password databases, password manager files and crypto wallets

The timeline is frustrating. Attacks began around 10 September. Collabora committed the fix on 9 September and shipped it on 11 September, but the security advisory and CVE identifier only came out on 14 October. That meant many administrators had no clear warning for a month while the flaw was being exploited

Collabora blamed backlogs in GitHub's CVE process, which have grown because of a flood of AI generated bug reports. A study by Second Security found that the median gap between a fix and its CVE grew from 5.1 days in January to 39 days in August. That is a worrying trend for everyone who relies on advisories to know when to patch

Administrators should upgrade or remove the app, because simply disabling it is not enough. Some users have claimed ransomware gangs are involved, although BleepingComputer could not confirm that. Self hosting gives control, but it also means taking responsibility for security updates

How do you keep up with security updates for self hosted software? And what should be done about the growing CVE backlog?

Hackers exploit Collabora RCE flaw to backdoor Nextcloud serverswww.bleepingcomputer.com