Nextcloud: flaw in Collabora app allows backdoors on servers

Nextcloud is a collaboration and cloud storage platform widely used by SMBs to share files and work on documents securely. However, Nextcloud's security depends not only on the core, but also on the optional applications that are installed. One of them, Collabora Online - Built-in CODE Server, which allows editing office documents directly in the browser, has been the attack vector to compromise Nextcloud servers.

According to The Hacker News, attackers have exploited a vulnerability in that app to place web shells on the servers. A web shell is a small file that executes commands sent by the attacker through web requests, with the privileges of the web server account. This allows persistent remote control and the possibility of escalating the attack.

So far, three administrators have reported the problem on GitHub, and the first recorded attack dates back to September 10. The news does not specify the affected version or whether a patch is available, but it does make clear that the flaw is in an optional application that many teams install to facilitate collaborative editing.

What does this attack mean for an SMB?

For an SMB that uses Nextcloud as a central work tool, this incident is a wake-up call about managing third-party applications. Often, IT teams install apps to add functionality without thoroughly evaluating their security or maintenance. If one of those apps has a critical vulnerability, the entire server is exposed.

Furthermore, a web shell allows the attacker to execute commands, steal data, install additional backdoors, or move laterally across the network. In a business environment, this can lead to a leak of confidential information, service interruption, or even ransomware.

Recommendations to protect your Nextcloud

At ForgeNEX we recommend that SMBs and IT teams follow these guidelines to reduce risk:

• Review installed applications: remove all optional apps that are not strictly necessary. If you do not use Collabora Online - Built-in CODE Server, disable or uninstall it.
• Keep everything updated: both the Nextcloud core and the apps must be on the latest version. Patches usually fix known vulnerabilities.
• Monitor suspicious files: look for strange PHP files in Nextcloud directories, especially in application or data folders. A web shell usually has random names or unusual extensions.
• Limit permissions: the web server should not have write permissions in critical directories. Apply the principle of least privilege.
• Review logs: look for unusual HTTP requests, especially those that attempt to execute commands or access unauthorized files.
• Make backups: make sure you have recent and tested backups. In case of compromise, you can restore the service without paying a ransom.

If you suspect that your server has been compromised, isolate the machine from the network, change all passwords, and contact a security specialist. Do not try to clean the web shell manually without first performing a forensic analysis, as you could destroy necessary evidence.

Context: security in your own cloud

Nextcloud is an excellent alternative to proprietary cloud services, but it requires careful management. It is not enough to install it and forget about it; you must apply updates, review add-ons, and monitor activity. This incident reminds us that security is an ongoing process.

At ForgeNEX we have spoken on other occasions about the importance of validating trust in AI tools, as in the article AI in forensics: trust is not validation. The same principle applies here: we cannot blindly trust an app just because it is popular or integrated. We must verify its security and maintain a proactive attitude.

We have also analyzed how an AI agent can find an OTP bypass in production (An AI agent finds an OTP bypass in production: the lesson), which underscores the need to constantly audit our systems, even those we consider secure.

Conclusion

The vulnerability in Collabora Online - Built-in CODE Server is one more example that a platform's security depends on all its components. SMBs must take extreme precautions with optional apps and maintain rigorous security hygiene. If you need help reviewing your Nextcloud installation or implementing protection measures, at ForgeNEX we can advise you.

Source: The Hacker News. Analysis and adaptation: ForgeNEX.