Active Exploits Target Plex Media Server Vulnerabilities with Malware
Fixed vulnerabilities in the Plex Media Server are under active exploitation in attacks that install malware, including cryptominers and residential proxy apps, according to a researcher. A proof-of-concept exploit chain named Plex2Shell was developed using AI to achieve remote code execution, prompting warnings for users to update immediately.
Key points
- Fixed vulnerabilities in Plex Media Server are being actively exploited in the wild.
- Attacks successfully install cryptominers and residential proxy apps on vulnerable devices.
- A researcher created an exploit chain named Plex2Shell by chaining four vulnerabilities together.
- Users are advised to update to version 1.43.3 or restrict access to local networks.
What Happened
Recently fixed vulnerabilities in the Plex Media Server are currently under active exploitation in attacks that install malware, including cryptominers and residential proxy apps, a researcher reported.
Plex fixed four vulnerabilities at the start of the prior month, followed three weeks later by published CVE designations revealing five vulnerabilities, one of which carried a severity rating of 8.6 out of 10. A researcher subsequently revealed an exploit chain named Plex2Shell that combined four of the vulnerabilities to achieve remote code execution on vulnerable devices.
What Changed
Following the publication of the exploit chain, a separate researcher set up a honeypot to track attempts to exploit the vulnerability chain in the wild. Within a day, active scanning and successful infection attempts were observed.
The successful attacks deploy two primary payloads: a cryptominer to generate cryptocurrency for the attacker, and residential proxy software that allows third parties to route traffic through the infected device.
Availability and Mitigation
Plex users should ensure their software is running version 1.43.3. Users can configure the software to install updates automatically or download and install them manually.
Additional security recommendations include restricting server access to local networks, routing traffic through a reverse proxy instead of using default port 32400, using secure Plex apps, and employing strong passwords.
Why it matters
Active exploitation of Plex Media Server vulnerabilities poses an immediate security risk to users, who face malware infection if they fail to update.
What we know
- Plex Media Server fixed vulnerabilities are under active exploitation to install cryptominers and residential proxy apps.
- A researcher developed the Plex2Shell exploit chain using AI to chain four vulnerabilities for remote code execution.
- Users are advised to update to Plex version 1.43.3 to address the issue.
What remains unclear
- Plex representatives did not immediately respond to questions regarding the active exploitation.
How the story developed
Ars Technica reports active exploitation of Plex Media Server vulnerabilities
A report detailed that recently fixed Plex vulnerabilities are under active exploitation, installing cryptominers and residential proxy apps.
Original source
