Collabora Online Built-in CODE Server (richdocumentscode) Proxy OS Command Injection and Remote Code Execution (RCE) Vulnerability (CVE-2025-66208)

1. Apply Official Security Patch

Immediately upgrade the richdocumentscode application to version 25.04.702 or later via the Nextcloud App Store or command-line interface.

Upgrade via Nextcloud CLI (occ):

sudo -u www-data php occ app:update richdocumentscode

2. Temporary Mitigation Measures

If an immediate upgrade is not feasible, implement the following workarounds:

• Web Application Firewall (WAF) Rules:

Deploy rules to inspect and block requests targeting proxy.php that contain shell metacharacters (e.g., ;, &, |, ` `, $()`).

• Reverse Proxy Access Control:

Restrict external access to the proxy.php endpoint using your web server configuration (Nginx/Apache).

  # Nginx Example: Restrict access to proxy.php
  location ~* /apps/richdocumentscode/proxy.php {
      allow 10.0.0.0/8; # Replace with trusted internal network
      deny all;
      fastcgi_pass php-handler;
  }

This vulnerability (CVE-2025-66208) is a critical OS Command Injection (CWE-78) vulnerability residing in the proxy mechanism of the richdocumentscode application, which serves as the built-in Collabora Online server for Nextcloud.

Root Cause & Attack Vector

• Improper Input Sanitization: The proxy.php component in richdocumentscode forwards requests to the internal CODE server. It fails to properly sanitize or escape user-supplied inputs before passing them to system shell execution contexts.
• Reverse Proxy Exploitation: Attackers can leverage intermediate reverse proxies to manipulate headers or request parameters, forcing proxy.php to process malicious payloads.
• Impact: Since the vulnerability requires no privileges and can be exploited remotely (AV:N/AC:L/PR:N/UI:N), successful exploitation grants the attacker arbitrary command execution capabilities under the context of the web server user (e.g., www-data).