Security researchers have identified ongoing attacks targeting unpatched installations of Plex Media Server through a combination of recently disclosed vulnerabilities. The software vendor released fixes for four vulnerabilities at the start of last month, followed by the publication of CVE designations revealing five vulnerabilities total, with one rated 8.6 out of 10 in severity.
A researcher demonstrated an exploit chain dubbed “Plex2Shell” that strings together four of these vulnerabilities to achieve remote code execution on vulnerable systems. The proof-of-concept exploit performs a series of steps including an unauthenticated server-side request forgery attack, loopback pivoting, security token theft, payload delivery, and code execution. The researcher indicated that artificial intelligence tools were employed extensively during development, though the judgment and strategic decisions remained human-directed.
Following the public disclosure of the exploit chain, a separate researcher created a honeypot to monitor real-world exploitation attempts. Within a single day of deployment, the simulated Plex server detected active scanning activity and eventually successful infection attempts. The attacks have been installing two distinct payloads: cryptomining software that appropriates computing resources to generate cryptocurrency sent to attacker-controlled wallets, and residential proxy applications that enable internet anonymization for users, including those conducting illegal activities.
Users are advised to update immediately to Plex version 1.43.3 or later, as the vulnerabilities are being actively exploited in the wild. The software supports automatic updates or manual installation. Security best practices include restricting server access to local networks only when feasible, utilizing reverse proxies instead of default port 32400 when internet connectivity is necessary, installing only verified Plex applications, and maintaining strong authentication credentials. Plex representatives have not yet responded to inquiries regarding the attacks.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI