Security researchers have documented active exploitation of recently patched vulnerabilities in Plex Media Server. The company released fixes earlier in the month for four identified weaknesses. Subsequently, five vulnerabilities were assigned CVE designations, with one rated 8.6 out of 10 in severity.
A researcher last week published details of an exploit chain called “Plex2Shell” that combines four vulnerabilities to achieve remote code execution on devices running outdated Plex versions. The sophisticated attack string involved multiple steps including unauthenticated server-side request forgery, loopback pivoting, security token theft, and payload delivery. The researcher indicated that artificial intelligence tools played a significant role in developing the exploit, though human judgment directed the overall process.
Within days of the exploit chain’s public disclosure, a separate security researcher deployed a honeypot to monitor real-world attack attempts. The monitoring system detected both scanning activity and successful compromises. Confirmed attacks have delivered two categories of malicious payloads: cryptominers that commandeer system resources to generate cryptocurrency for attackers, and residential proxy applications that allow threat actors to route traffic through infected devices for anonymization purposes.
Security researchers have noted that residential proxies installed on home networks are particularly valuable to attackers seeking to bypass corporate security controls and gain unauthorized access to business infrastructure. Users of Plex Media Server are advised to update immediately to version 1.43.3, either through automatic update settings or manual installation. Additional protective measures include restricting access to local networks only, using reverse proxies to mask the standard port, employing only official Plex applications, and maintaining strong authentication credentials.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI