Users of Plex media servers face active attacks after a researcher published an exploit chain that takes over vulnerable devices, and successful compromises are already installing malware in the wild. Plex fixed four vulnerabilities at the start of last month. Three weeks later, published CVE designations revealed five vulnerabilities, one of them rated 8.6 out of 10 for severity. A researcher last week disclosed an exploit that chained four of them together to achieve remote code execution on devices running a vulnerable Plex version, and named the chain “Plex2Shell.”
The new details let a second researcher build a honeypot to track exploitation attempts in the wild. Within a day, that researcher began seeing active scanning of the simulated Plex server and eventually successful attempts to infect devices. The attacks so far are installing two payloads. One is a cryptominer that uses the device to mine cryptocurrency and deposit it into a wallet controlled by the attacker. The other is residential proxy software, which lets people anonymize Internet activity, much of it illegal, by connecting to the infected box and using it to send the user’s traffic to a final destination.
The second researcher wrote that Plex may be hosted on residential IPs and that threat actors would like a residential IP proxy to access corporate VPNs and emails. The published exploit chain was part of a proof-of-concept attack the first researcher included when submitting a bug report to Plex. The complex code completes a series of steps, including an unauthenticated SSRF, a loopback pivot, a security token theft, payload delivery, and finally execution of the payload.
The bug finder said he used AI heavily to develop the exploit chain. He wrote that this was not a matter of telling the LLM to go hack Plex, but rather hours of iterative work, dead ends, and reprioritization. He said all judgment calls on what to look for and what to prioritize were his, and that the LLM speeds the process up significantly, allowing him to stay at a higher level and simply guide the process.
Anyone using Plex should ensure it is running version 1.43.3. The software can be configured to install updates automatically, or users can manually download and install them. Given the active exploitation, outdated versions should be updated immediately.
Beyond patching, users should devote care to properly securing the media servers. The safest option is to restrict access to local networks with no exposure to the Internet, though that prevents use of many useful features. One option when connecting a device to the open Internet is to route traffic through a reverse proxy instead of using the default port 32400. Users should also use only secure Plex apps, and strong passwords are a must.
More cybersecurity news from TechManNews.
