Attackers Backdoor Nextcloud Servers via Collabora Online Built-in CODE Server Flaw
A critical vulnerability in an optional Nextcloud app has been exploited in the wild to plant web shells on Nextcloud servers, according to a report from The Hacker News. The flaw resides in Collabora Online - Built-in CODE Server, a component that administrators can install to enable collaborative document editing directly within Nextcloud. While the app is not part of a default Nextcloud installation, its presence opens a dangerous attack path.
What Happened
Attackers leveraged the vulnerability to deploy web shells—small, malicious scripts that allow an attacker to execute arbitrary commands on a compromised server via HTTP requests. These commands run with the privileges of the web server account, giving attackers a foothold to further compromise the host, exfiltrate data, or pivot into internal networks.
The first known attack was recorded on September 10. Three Nextcloud administrators independently reported the issue on GitHub, indicating that the exploitation was not an isolated incident. The reports prompted the Nextcloud community and security teams to investigate the Collabora app as the initial access vector.
Understanding the Risk
Web shells are a common post-exploitation tool because they are lightweight, hard to detect with signature-based defenses, and provide persistent remote access. Once a web shell is in place, an attacker can:
- Execute system commands
- Read, modify, or delete files
- Install additional malware or backdoors
- Escalate privileges and move laterally
The fact that the exploited component is an optional app underscores a recurring theme in web application security: third-party extensions and integrations often expand the attack surface beyond what core developers can control. Even if Nextcloud itself is hardened, a single vulnerable plugin can undermine the entire deployment.
Who Is Affected
The vulnerability specifically impacts Nextcloud instances where the Collabora Online - Built-in CODE Server app is installed and enabled. Administrators who have never installed this optional component are not directly affected by this particular flaw. However, the incident serves as a reminder to audit all installed apps and integrations.
Mitigation and Recommendations
In response to the reports, the Nextcloud team and Collabora maintainers are expected to release patches or workarounds. Until an official fix is available, administrators should take the following steps:
- Check for the Collabora app – Verify whether the Built-in CODE Server is installed. If it is not needed, disable and remove it immediately.
- Inspect for web shells – Look for unusual files in web-accessible directories, especially those with obfuscated code or unexpected PHP, JSP, or ASP extensions. Tools like
find,grep, and specialized web shell scanners can help. - Review logs – Examine web server access logs for suspicious POST requests, unusual user agents, or requests to unfamiliar files, particularly around September 10 and later.
- Apply updates promptly – Once a patch is released, apply it without delay. Subscribe to Nextcloud security advisories and Collabora announcements.
- Harden permissions – Ensure the web server runs with the least privileges necessary. This limits the impact of a web shell even if one is planted.
- Consider a web application firewall (WAF) – A WAF can block some exploitation attempts, though it is not a substitute for patching.
Broader Implications
This incident highlights the supply chain and integration risks that come with modular platforms. Nextcloud is widely used for file sharing and collaboration, often in sensitive environments. An optional app that enables document editing may seem innocuous, but it introduces a separate codebase with its own vulnerabilities. Organizations should treat every plugin, extension, and integration as part of their attack surface and include them in vulnerability management programs.
Moreover, the fact that three separate administrators reported the issue suggests that the attackers were actively scanning for vulnerable instances. Automated exploitation of known flaws is a hallmark of modern cybercrime, and defenders must assume that any unpatched, internet-facing service will be targeted.
What’s Next
As of the report, details about the exact nature of the flaw—such as whether it is a remote code execution, path traversal, or file upload vulnerability—remain limited. The Hacker News notes that the flaw is critical, and the exploitation has been confirmed. Administrators should monitor official channels for a patch and indicators of compromise.
For now, the priority is clear: identify whether your Nextcloud instance runs the Collabora Online Built-in CODE Server app, remove it if unnecessary, and hunt for signs of compromise. The attack is a stark reminder that optional components can become critical liabilities when overlooked.
Source: The Hacker News
