Security researchers have documented widespread active exploitation of multiple vulnerabilities in Plex Media Server, with attackers successfully compromising unpatched installations to deliver malware payloads.
Plex addressed four vulnerabilities earlier in the month, followed by additional CVE designations revealing five vulnerabilities total, including one rated 8.6 out of 10 in severity. A researcher subsequently published details of an exploit chain dubbed “Plex2Shell” that combines four of these flaws to achieve remote code execution on vulnerable Plex instances. The vulnerability chain involves multiple exploitation steps, including an unauthenticated SSRF, loopback pivot, security token theft, payload delivery, and payload execution.
Within a day of the exploit becoming public, another researcher deployed a honeypot to monitor real-world attack attempts and observed successful infections of test systems. Threat actors are installing two primary payloads on compromised devices. The first is cryptocurrency mining software that uses system resources to generate cryptocurrency for attacker-controlled wallets. The second is residential proxy application software, which enables attackers and other malicious actors to route their internet traffic through infected residential devices to mask their activities and potentially gain access to corporate networks and email systems.
Plex users are advised to update to version 1.43.3 immediately, with automatic updates available as a configuration option. Security experts recommend implementing additional protective measures, including restricting Plex access to local networks when possible, using reverse proxies instead of default port 32400 for internet-exposed instances, employing only legitimate Plex applications, and utilizing strong authentication credentials. Plex has not yet publicly responded to inquiries regarding the active exploitation.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI