CVE-2026-110447: Collabora Online OS Command Injection — CISA KEV Detection and Remediation Guide

---
title: Collabora Online CODE Server Process Spawning Suspicious Shell Commands
id: 8f2a1b3c-9d4e-4f5a-8b6c-7d8e9f0a1b2c
status: experimental
description: Detects the Collabora Online built-in server process (coolwsd) spawning shell commands or script interpreters, indicative of command injection exploitation.
references:
  - https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog-0
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/10/24
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/coolwsd'
      - '/coolforkit'
  selection_suspicious:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/php'
      - '/nc'
      - '/ncat'
      - '/netcat'
      - '/curl'
      - '/wget'
  condition: selection_parent and selection_suspicious
falsepositives:
  - Legitimate document conversion scripts or administrative maintenance
level: high
---
title: Collabora Online Web Directory Webshell Creation
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects creation of script files in Collabora Online web-accessible directories, a common post-exploitation behavior following command injection.
references:
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/10/24
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_paths:
    TargetFilename|startswith:
      - '/usr/share/coolwsd/browser/'
      - '/opt/collaboraoffice/'
      - '/var/www/html/'
      - '/srv/www/'
  selection_extensions:
    TargetFilename|endswith:
      - '.php'
      - '.jsp'
      - '.jspx'
      - '.asp'
      - '.aspx'
      - '.py'
      - '.pl'
      - '.sh'
  condition: selection_paths and selection_extensions
falsepositives:
  - Legitimate administrative updates or template deployments
level: medium
---
title: Collabora Online Suspicious Outbound Network Connections
id: 2b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Identifies Collabora Online server processes initiating unexpected outbound network connections, potentially indicating C2 communication or reverse shell establishment.
references:
  - https://attack.mitre.org/techniques/T1071/001/
author: Security Arsenal
date: 2026/10/24
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith:
      - '/coolwsd'
      - '/coolforkit'
    DestinationIp|re: '^(?!10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.|::1|fe80::)'
  filter_ports:
    DestinationPort:
      - 443
      - 80
  condition: selection and not filter_ports
falsepositives:
  - Software update mechanisms, legitimate cloud storage synchronization
level: medium

// Hunt 1: Collabora processes spawning suspicious child processes
let suspicious_procs = dynamic(["bash", "sh", "python", "python3", "perl", "nc", "ncat", "curl", "wget"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any ("coolwsd", "coolforkit", "loolwsd")
| where FileName has_any (suspicious_procs)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName, FolderPath
| order by TimeGenerated desc;

// Hunt 2: Network connections from Collabora processes to non-standard ports
let collabora_procs = dynamic(["coolwsd", "coolforkit", "loolwsd"]);
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any (collabora_procs)
| where RemotePort !in (80, 443, 8080, 8443, 9980)
| where not(RemoteIP startswith "10." or RemoteIP startswith "192.168." or RemoteIP startswith "172.")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessCommandLine
| order by TimeGenerated desc;

// Hunt 3: File creation in Collabora web directories
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FolderPath has_any ("coolwsd", "collabora", "loolwsd", "/var/www/", "/usr/share/coolwsd/")
| where FileName endswith ".php" or FileName endswith ".sh" or FileName endswith ".py" or FileName endswith ".jsp"
| where not(FolderPath has "templates" or FolderPath has "systemplate")
| project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by TimeGenerated desc;

-- Hunt for suspicious child processes of Collabora Online server processes
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime,
       dict(Pid=Ppid, Name=Name) as ParentInfo
FROM pslist()
WHERE Name =~ "coolwsd|coolforkit|loolwsd"
   OR Exe =~ "/usr/bin/cool|/opt/collabora"
   OR CommandLine =~ "bash|sh|python|perl|nc|curl|wget"

#!/bin/bash
# CVE-2026-110447 Collabora Online Detection and Triage Script
# Run with root privileges for complete visibility

set -euo pipefail

LOG_FILE="/var/log/collabora_triage_$(date +%Y%m%d_%H%M%S).log"
ALERTS_FOUND=0

log() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE"
}

check_root() {
    if [[ $EUID -ne 0 ]]; then
        log "ERROR: This script must be run as root or with sudo"
        exit 1
    fi
}

identify_installations() {
    log "=== Identifying Collabora Online Installations ==="
    
    # Check for system packages
    if command -v dpkg &> /dev/null; then
        dpkg -l | grep -E "coolwsd|collabora|loolwsd" | tee -a "$LOG_FILE" || log "No Debian packages found"
    elif command -v rpm &> /dev/null; then
        rpm -qa | grep -E "coolwsd|collabora|loolwsd" | tee -a "$LOG_FILE" || log "No RPM packages found"
    fi
    
    # Check for running processes
    pgrep -a -f "coolwsd|coolforkit|loolwsd" | tee -a "$LOG_FILE" || log "No Collabora processes running"
    
    # Check common installation directories
    for dir in /usr/share/coolwsd /opt/collaboraoffice /usr/lib/coolwsd; do
        if [[ -d "$dir" ]]; then
            log "Found installation directory: $dir"
            find "$dir" -type f -name "*.xml" -o -name "*.json" | head -5 | tee -a "$LOG_FILE"
        fi
    done
}

check_webshells() {
    log "=== Checking for Suspicious Files in Web Directories ==="
    
    local web_dirs=("/usr/share/coolwsd/browser" "/opt/collaboraoffice" "/var/www/html")
    
    for dir in "${web_dirs[@]}"; do
        if [[ -d "$dir" ]]; then
            log "Scanning $dir for suspicious files..."
            
            # Look for recently created script files (last 7 days)
            find "$dir" -type f \( -name "*.php" -o -name "*.sh" -o -name "*.py" -o -name "*.jsp" \) \
                -mtime -7 -ls 2>/dev/null | while read -r line; do
                log "ALERT: Suspicious file found: $line"
                ((ALERTS_FOUND++))
            done
            
            # Check for files with suspicious names
            find "$dir" -type f \( -name "shell.*" -o -name "cmd.*" -o -name "backdoor.*" -o -name "c99.*" -o -name "r57.*" \) \
                -ls 2>/dev/null | while read -r line; do
                log "ALERT: Potentially malicious filename: $line"
                ((ALERTS_FOUND++))
            done
        fi
    done
}

check_process_anomalies() {
    log "=== Checking for Process Anomalies ==="
    
    # Find coolwsd processes and their children
    local cool_pids
    cool_pids=$(pgrep -f "coolwsd" || true)
    
    if [[ -n "$cool_pids" ]]; then
        for pid in $cool_pids; do
            log "Analyzing child processes of coolwsd PID $pid:"
            
            # Get child processes
            local children
            children=$(pgrep -P "$pid" || true)
            
            for child in $children; do
                local child_cmd
                child_cmd=$(ps -p "$child" -o comm=,args= 2>/dev/null || echo "Unknown")
                
                # Check for suspicious commands
                if echo "$child_cmd" | grep -qE "(bash|sh|python|perl|nc|ncat|curl|wget)"; then
                    log "ALERT: Suspicious child process detected: PID $child - $child_cmd"
                    ((ALERTS_FOUND++))
                    
                    # Capture additional context
                    ls -la "/proc/$child/exe" 2>/dev/null | tee -a "$LOG_FILE" || true
                    cat "/proc/$child/cmdline" 2>/dev/null | tr '\0' ' ' | tee -a "$LOG_FILE" || true
                    echo "" | tee -a "$LOG_FILE"
                fi
            done
        done
    else
        log "No running coolwsd processes found"
    fi
}

check_network_connections() {
    log "=== Checking Network Connections ==="
    
    local cool_pids
    cool_pids=$(pgrep -f "coolwsd" || true)
    
    if [[ -n "$cool_pids" ]]; then
        for pid in $cool_pids; do
            log "Network connections for coolwsd PID $pid:"
            ss -tunap 2>/dev/null | grep -E "pid=$pid" | while read -r conn; do
                log "  $conn"
                
                # Alert on non-standard ports or suspicious IPs
                if echo "$conn" | grep -qE ":(4444|5555|6666|7777|8888|9999|1337|31337)"; then
                    log "ALERT: Suspicious port detected in connection: $conn"
                    ((ALERTS_FOUND++))
                fi
            done
        done
    fi
}

check_logs_for_exploitation() {
    log "=== Checking Collabora Logs for Exploitation Attempts ==="
    
    local log_files=("/var/log/coolwsd.log" "/var/log/loolwsd.log" "/var/log/syslog" "/var/log/messages")
    
    for logfile in "${log_files[@]}"; do
        if [[ -f "$logfile" ]]; then
            log "Scanning $logfile for suspicious patterns..."
            
            # Look for shell metacharacters in requests
            grep -E "(;|\||\`|\$\()" "$logfile" 2>/dev/null | grep -E "(GET|POST|PUT)" | tail -20 | while read -r line; do
                log "POTENTIAL EXPLOITATION: $line"
                ((ALERTS_FOUND++))
            done || true
            
            # Look for common webshell names in logs
            grep -iE "(shell|cmd|backdoor|webshell)" "$logfile" 2>/dev/null | tail -10 | while read -r line; do
                log "SUSPICIOUS LOG ENTRY: $line"
                ((ALERTS_FOUND++))
            done || true
        fi
    done
}

verify_patch_level() {
    log "=== Patch Verification Information ==="
    log "Please consult the official Collabora Online security advisory for the exact fixed version numbers."
    log "Check your current version with: coolwsd --version or loolwsd --version"
    log "Ensure you are running a version released after October 2026 that addresses CVE-2026-110447."
    
    # Attempt to get version if binary exists
    if command -v coolwsd &> /dev/null; then
        log "Current coolwsd version:"
        coolwsd --version 2>&1 | tee -a "$LOG_FILE" || true
    fi
}

main() {
    log "Starting CVE-2026-110447 triage for Collabora Online"
    log "Hostname: $(hostname)"
    log "Date: $(date)"
    
    check_root
    identify_installations
    check_webshells
    check_process_anomalies
    check_network_connections
    check_logs_for_exploitation
    verify_patch_level
    
    log "=== Triage Complete ==="
    if [[ $ALERTS_FOUND -gt 0 ]]; then
        log "WARNING: $ALERTS_FOUND suspicious indicators found. Immediate incident response recommended."
        exit 2
    else
        log "No immediate indicators of compromise detected."
        log "NOTE: This does not guarantee the system is clean. Ensure patching is prioritized."
        exit 0
    fi
}

main "$@"