Security researchers have disclosed that multiple vulnerabilities in Plex Media Server are being actively exploited in the wild. Plex released fixes for four vulnerabilities at the start of last month, followed by the publication of five CVE designations, including one rated at 8.6 severity. A researcher subsequently unveiled an exploit chain dubbed “Plex2Shell” that combines four of these flaws to achieve remote code execution on devices running vulnerable Plex versions.
The exploit chain performs a series of technical steps including unauthenticated SSRF attacks, loopback pivots, security token theft, and payload delivery to compromise affected systems. The researcher indicated that artificial intelligence tools were used extensively during the development process, though the core decisions about what vulnerabilities to target and prioritize remained the researcher’s responsibility.
Once systems are successfully compromised, attackers are observed installing two types of malware payloads. The first variant functions as a cryptominer, using the infected device’s computational resources to generate cryptocurrency directed to attacker-controlled wallets. The second payload is residential proxy software that enables users to route their internet traffic through the compromised device to obscure their identity and location, potentially facilitating illegal activities and providing access to corporate networks and email systems.
Security researchers created a honeypot to monitor exploitation attempts and detected active scanning and successful infection attempts within hours of deployment. To mitigate risk, Plex users are advised to update to version 1.43.3 immediately. Administrators can configure automatic updates or manually install patches. Additional security measures include restricting server access to local networks only, using a reverse proxy to avoid exposing the default port, employing only secure Plex applications, and maintaining strong authentication credentials.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI