Security researchers have documented active attacks exploiting recently patched vulnerabilities in Plex Media Server. Plex addressed four vulnerabilities at the start of last month, and three weeks later, five designated vulnerabilities were publicly disclosed, including one rated 8.6 out of 10 in severity.
A researcher demonstrated an exploit chain dubbed “Plex2Shell” that combines four of these vulnerabilities to achieve remote code execution on systems running vulnerable Plex versions. The chain involves multiple attack steps including an unauthenticated server-side request forgery attack, network pivoting, security token theft, and payload delivery. The researcher indicated that artificial intelligence tools played a significant role in developing the complex exploit, though human judgment directed the overall approach and prioritization of attack vectors.
Following public disclosure of the exploit chain, a second researcher deployed a honeypot to monitor real-world exploitation attempts. Within one day, the simulated Plex server detected active scanning, and successful infections soon followed. Attackers are deploying two categories of malware: cryptocurrency miners that utilize infected systems’ computing resources to generate revenue for attackers, and residential proxy applications that enable users to route internet traffic through compromised home networks to mask their activities and potentially access corporate systems.
Plex users are advised to update immediately to version 1.43.3 or later, with automatic updates available as an option. Beyond patching, security recommendations include restricting Plex access to local networks only, using reverse proxies to obscure default ports, employing only official Plex applications, and implementing strong authentication credentials. Plex did not immediately respond to inquiries about the vulnerability chain and exploitation campaign.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI