Home / Technology / Plex Exploited: Hackers Chain 4 Flaws
Plex Exploited: Hackers Chain 4 Flaws
20 Oct
Summary
- Four Plex vulnerabilities are chained for remote code execution.
- Exploits install cryptominers and residential proxy malware.
- Users must update to Plex version 1.43.3 immediately.
Security researchers have revealed that attackers are actively exploiting a chain of four vulnerabilities in Plex Media Server to gain remote code execution on unpatched systems. This exploit chain, named Plex2Shell, was developed by a researcher who heavily utilized AI in the process.
Within a day of setting up a honeypot, active scanning and successful infection attempts were observed. The deployed malware includes cryptominers, which steal device resources to mine cryptocurrency, and residential proxy software, enabling anonymized internet traffic for potentially illegal activities. Attackers could leverage these proxies to access corporate VPNs or emails.
Plex released fixes for these vulnerabilities last month, and later published CVE designations for five flaws, one with a severity rating of 8.6. The exploit chain involves complex steps like SSRF, security token theft, and payload delivery.
Plex representatives did not immediately respond to inquiries regarding the exploitation. Users are strongly advised to update to Plex Media Server version 1.43.3. For enhanced security, restricting server access to local networks or routing traffic through a reverse proxy is recommended if internet exposure is necessary. Ensuring the use of secure Plex apps and strong passwords is also crucial.
