Critical Flaw in Nextcloud's CODE App Exploited for Server Backdoors

Security researchers have identified active exploitation of a critical vulnerability in the Collabora Online - Built-in CODE Server app for Nextcloud. This optional component has been targeted by attackers to deploy web shells, which enable remote command execution with the privileges of the web server.

Multiple administrators reported suspicious activity starting September 10, leading to the discovery of unauthorized files on their Nextcloud instances. Organizations using the affected app are advised to take immediate action to assess and remediate potential compromises.

Vulnerability Details

• The flaw resides in the Collabora Online - Built-in CODE Server app, an optional plugin for Nextcloud deployments.
• Attackers used the vulnerability to upload and execute web shells, gaining persistent access to affected servers.
• Web shells allow full remote command execution under the context of the web server account.
• The built-in nature of the CODE server increases its attack surface within default configurations.

Impact and Recommendations

• Organizations running Nextcloud with the Collabora CODE app should audit their systems for unknown PHP files.
• Administrators are urged to update to the latest patched version of the app immediately.
• Indicators of compromise include unexpected network traffic and unfamiliar files in web-accessible directories.
• Proactive monitoring for post-exploitation activities such as lateral movement is strongly advised.

Sources

• Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App