Nextcloud Collabora CODE (CVE-2026-110447)

title: richdocumentscode proxy.php Command Substitution Markers
id: 7c2e1a90-4b6d-5e18-9f3a-2d8c1b0e6a44
status: experimental
description: Hunts web access logs for requests to the Collabora Built-in CODE Server proxy that include command-substitution or traversal markers reported by administrators for CVE-2026-110447.
references:
    - https://github.com/CollaboraOnline/richdocumentscode/issues/354
    - https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh
author: vuln2shell
date: 2026-10-24
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2026-110447
logsource:
    category: webserver
detection:
    endpoint:
        cs-uri-stem|contains: '/apps/richdocumentscode/proxy.php'
    markers:
        cs-uri-query|contains:
            - '$('
            - '%24%28'
            - '${IFS}'
            - 'base64'
            - '%2e%2e'
        cs-uri-stem|contains:
            - '$('
            - '%24%28'
            - '${IFS}'
            - 'base64'
            - '%2e%2e'
    condition: endpoint and markers
falsepositives:
    - Rare legitimate query strings that include the word base64
level: high

(sourcetype=access_combined OR sourcetype=nginx_access OR sourcetype=nginx:plus:access OR sourcetype=apache:access)
("/apps/richdocumentscode/proxy.php")
("$(" OR "%24%28" OR "${IFS}" OR "base64" OR "%2e%2e")
| stats count min(_time) as firstTime max(_time) as lastTime values(clientip) as src by host, uri, status

DeviceFileEvents
| where Timestamp > ago(45d)
| where FolderPath has "richdocumentscode"
| where FileName endswith ".php"
| where ActionType has "FileCreated"
| project Timestamp, DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessAccountName, SHA256
| order by Timestamp desc

DeviceProcessEvents
| where Timestamp > ago(45d)
| where AccountName in~ ("www-data", "apache", "nginx", "http", "www")
    or InitiatingProcessFileName in~ ("apache2", "httpd", "nginx", "php-fpm", "php")
| where FileName in~ ("sh", "bash", "dash", "curl", "wget")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by Timestamp desc

/apps\/richdocumentscode\/proxy\.php/
| regex("(?:\\$\\(|%24%28|\\$\\{IFS\\}|base64|%2e%2e)")
| groupBy([#host, uri, statuscode], function=count())

#event_simpleName=ProcessRollup2 event_platform=Lin
| UserName=/^(www-data|apache|nginx|http|www)$/i or ParentBaseFileName=/^(apache2|httpd|nginx|php-fpm|php)$/i
| FileName=/^(sh|bash|dash|curl|wget)$/i
| groupBy([aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=max)

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"VULN2SHELL HUNTING Collabora richdocumentscode proxy.php command-substitution markers (CVE-2026-110447)"; flow:established,to_server; http.uri; content:"/apps/richdocumentscode/proxy.php"; nocase; pcre:"/(\$\(|%24%28|\$\{IFS\}|base64|%2e%2e)/i"; reference:cve,2026-110447; reference:url,github.com/CollaboraOnline/richdocumentscode/issues/354; classtype:web-application-attack; sid:1000002; rev:1;)