Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Organizations using Collabora Online/Nextcloud and Arista VeloCloud Orchestrator
Incident: Active exploitation of RCE and SQL injection vulnerabilities in enterprise collaboration and networking software.
Impact: Remote code execution, sensitive data theft, and unauthorized privileged access to network infrastructure.
Attacker: Unidentified threat actors
Analysis: Threat actors are leveraging a command injection flaw in Collabora Online to deploy web shells and harvest sensitive data from Nextcloud environments. Simultaneously, an SQL injection vulnerability in Arista VeloCloud Orchestrator is being used by authenticated users to gain privileged access. Both flaws have been added to CISA’s KEV catalog due to confirmed real-world exploitation.
Recommendations: Immediately update Collabora Online to version 26.4.303 or newer.; Patch Arista VeloCloud Orchestrator to versions 5.2.3.18, 6.1.3.10, or 6.4.2.12.; Review Nextcloud logs for unauthorized access to proxy.php and unexpected web shell activity.
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source