Attackers Exploit Vulnerabilities in Arista VeloCloud and Collabora/Nextcloud
Cyberattacks targeting Arista VeloCloud and Collabora Online integrated with Nextcloud are actively occurring, according to US cybersecurity authorities.
Attackers are exploiting vulnerabilities in Arista VeloCloud Orchestrator and the Collabora Online Built-in CODE Server within Nextcloud environments, leading to the installation of webshells on Nextcloud servers. The US Cybersecurity and Infrastructure Security Agency (CISA) has issued warnings regarding these attacks, highlighting a critical SQL injection vulnerability in Arista VeloCloud Orchestrator.
The Collabora Online vulnerability allows attackers to execute commands on the web server’s user account without authentication, primarily during container restarts or upgrades. Users running unsupported Nextcloud versions up to version 29 are advised to update Nextcloud or remove the Collabora app, as the patched version requires Nextcloud 30 or later.
Collabora Online developers have confirmed the issue, with initial reports appearing in their issue tracker as early as September 11th. Administrators are urged to check their systems for signs of compromise and promptly apply available updates to mitigate the risks.