Security vulnerabilities in Plex Media Server have become the subject of active exploitation in the wild, according to recent findings from multiple researchers. Plex released patches addressing four vulnerabilities early in September, with additional CVE designations published weeks later identifying five total vulnerabilities, including one rated 8.6 out of 10 in severity.
A researcher last week publicly disclosed an exploit demonstrating how four of these vulnerabilities could be chained together to achieve remote code execution on devices running unpatched versions of the software. Dubbed “Plex2Shell,” the exploit performs a series of complex steps including an unauthenticated SSRF attack, loopback pivot, security token theft, payload delivery, and code execution. The researcher indicated that artificial intelligence tools played a significant role in developing the exploit chain, though emphasized that the creative direction and technical judgment came from the researcher’s own analysis.
Following the public disclosure, a second researcher created a honeypot to monitor real-world exploitation attempts. Within a day of deployment, the system detected active scanning and eventually successful compromise attempts. Infected devices have been observed receiving two types of malware payloads: cryptominers that hijack computational resources to generate cryptocurrency for attackers, and residential proxy software that allows threat actors to anonymize and route internet traffic through compromised home networks.
Security experts have raised particular concern about the proxy payload, noting that residential IP addresses could provide valuable access to corporate networks and email systems. Users of Plex Media Server are advised to immediately update to version 1.43.3, which addresses the identified vulnerabilities. Additional protective measures recommended include restricting server access to local networks only, routing internet-facing traffic through a reverse proxy using non-default ports, maintaining strong authentication credentials, and using only legitimate Plex applications.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI