CVE-2023-48314
📋 TL;DR
This CVE describes a cross-site scripting (XSS) vulnerability in Collabora Online's proxy.php component when used with Nextcloud's Built-in CODE Server app. Attackers can inject malicious scripts that execute in users' browsers when they access the vulnerable component. Only Nextcloud instances with Collabora Online Built-in CODE Server app are affected.
💻 Affected Systems
- Collabora Online - Built-in CODE Server (richdocumentscode)
📦 What is this software?
Collabora Online by Collaboraoffice
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, or redirect users to malicious sites, potentially leading to account compromise and data theft.
Likely Case
Attackers inject malicious JavaScript that steals session tokens or performs unauthorized actions within the user's context, leading to account takeover or data exposure.
If Mitigated
With proper input validation and output encoding, the malicious payloads would be neutralized before reaching users' browsers.
🎯 Exploit Status
The advisory indicates exploitation via proxy.php, suggesting direct HTTP requests could trigger the vulnerability without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 23.5.403
Vendor Advisory: https://github.com/CollaboraOnline/online/security/advisories/GHSA-qjrm-q4h5-v3r2
Restart Required: Yes
Instructions:
1. Access Nextcloud admin interface. 2. Navigate to Apps section. 3. Find 'Collabora Online - Built-in CODE Server' app. 4. Update to version 23.5.403 or later. 5. Restart the Nextcloud service.
🧯 If You Can't Patch
- Disable the Collabora Online Built-in CODE Server app if not required.
- Restrict network access to the Nextcloud instance to trusted IPs only.
🔍 How to Verify
Check if Vulnerable:
Check the app version in Nextcloud admin interface under Apps > Installed apps > Collabora Online - Built-in CODE Server.Check Version:
In Nextcloud admin interface: Apps > Installed apps > Collabora Online - Built-in CODE ServerVerify Fix Applied:
Verify the app version shows 23.5.403 or higher after update.📡 Detection & Monitoring
Log Indicators:
- Unusual requests to proxy.php with suspicious parameters containing script tags or JavaScript code.
- Multiple failed access attempts to proxy.php from unusual IPs.
Network Indicators:
- HTTP requests to /apps/richdocumentscode/proxy.php with encoded script payloads in parameters.
SIEM Query:
source="nextcloud.log" AND "proxy.php" AND ("<script>" OR "javascript:" OR "onerror=" OR "onload=")