Security researchers have identified active exploitation of recently patched vulnerabilities in Plex Media Server, with successful attacks deploying malicious payloads on compromised devices.
Plex addressed four vulnerabilities at the start of last month, with five total vulnerabilities subsequently receiving CVE designations. One vulnerability carries a severity rating of 8.6 out of 10. A researcher disclosed an exploit chain named “Plex2Shell” that combines four of these vulnerabilities to achieve remote code execution on devices running unpatched Plex versions. The complex exploit involves multiple steps including unauthenticated SSRF attacks, loopback pivoting, security token theft, payload delivery, and execution. The researcher indicated that artificial intelligence tools were used extensively during development, though the researcher emphasized that AI was used iteratively to support rather than replace human judgment and decision-making.
Following publication of the exploit chain, a second researcher created a honeypot to monitor real-world exploitation attempts. Within a day, the honeypot detected active scanning of the simulated Plex server, with successful infection attempts occurring shortly thereafter. Compromised devices are being infected with two primary payloads: cryptomining software that uses device resources to generate cryptocurrency for attacker-controlled wallets, and residential proxy applications that enable users to anonymize their internet activity through the infected systems. Researchers noted that attackers may find residential IP addresses particularly valuable for accessing corporate VPNs and email systems.
Plex users are advised to update immediately to version 1.43.3, which can be configured for automatic updates or manually installed. Beyond patching, security measures include restricting media server access to local networks only, using reverse proxies instead of default ports, employing only secure Plex applications, and maintaining strong passwords.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI