Active attacks prompt PSA: patch your Plex media server before someone hacks unpatched devices
Attacks reach vulnerable servers
Plex corrected four flaws at the start of last month. Three weeks later, CVE designations disclosed five vulnerabilities, including one with a severity score of 8.6 out of 10.
Last week, a researcher demonstrated a chain of four flaws that can remotely execute code on a device running an affected Plex version. The researcher called the exploit “Plex2Shell.” Using those details, another researcher set up a honeypot to observe attacks. Scanning began within a day, followed by successful infections, the researcher reported.
Two payloads reported
Successful attacks have installed two kinds of software so far, according to the honeypot researcher. One is a cryptominer that uses the victim’s device to mine cryptocurrency for an attacker-controlled wallet.
The other is residential proxy software. It lets users route Internet traffic through an infected device to conceal its origin, a capability the researcher said could interest threat actors seeking residential IP addresses to reach corporate VPNs and email.
How the exploit was built
The first researcher submitted the exploit chain to Plex as part of a proof-of-concept bug report. Its steps include an unauthenticated SSRF, a loopback pivot, theft of a security token, delivery of a payload, and execution.
The researcher said AI played a substantial role in developing the chain, but described the work as iterative, with dead ends and changing priorities. The researcher said the decisions about what to investigate and prioritize remained theirs.
Update and reduce exposure
Plex users should make sure their servers run version 1.43.3. Updates can be installed automatically or downloaded and installed manually; the article urges users of older versions to update immediately.
The safest option described is restricting server access to local networks, though that limits some features. For servers connected to the open Internet, users can route traffic through a reverse proxy rather than the default port 32400, use secure Plex apps, and set strong passwords.
Key points
- Researchers report active exploitation of vulnerabilities in Plex Media Server.
- Successful infections have installed cryptominers and residential proxy software.
- The exploit chain, named Plex2Shell, combines four flaws for remote code execution.
- Update Plex Media Server to version 1.43.3 and secure its network access.