Critical Plex Media Server Vulnerabilities Exploited in Active Malware Attacks

Image: Ars Technica · Source

Multiple security flaws in Plex Media Server have been exploited to deploy malware, including cryptominers and proxy software; users are urged to update to version 1.43.3 immediately to prevent remote code execution.

Security researchers have revealed that a series of vulnerabilities patched in the Plex Media Server were quickly targeted by attackers to deliver malicious software. The Plex team addressed four critical security issues in an update released last month, but subsequent disclosures showed five vulnerabilities, with one rated at 8.6 out of 10 severity. A new exploit chain, dubbed “Plex2Shell,” leverages four of these flaws in combination to achieve remote code execution on affected systems.

The exploit chain involves multiple complex steps, including unauthenticated server-side request forgery (SSRF), loopback pivoting, token theft, and eventual payload execution. Notably, the researcher who created the chain utilized artificial intelligence extensively to speed up the discovery and assembly of the exploit, though careful manual oversight guided the process.

Following the publication of these details, another researcher deployed honeypot servers simulating vulnerable Plex instances, which rapidly attracted scanning and successful infection attempts in the wild. The attacks observed dropped two main types of payloads: cryptocurrency miners that harness the infected system’s resources to generate cryptocurrency for attackers, and residential proxy software that enables anonymized, and often illicit, internet traffic routing through the compromised devices.

Because Plex servers often run on residential IP addresses, threat actors value these infected machines for hiding behind legitimate home network locations, potentially facilitating access to sensitive corporate resources such as VPNs and email systems.

Plex users are strongly advised to verify their installations are updated to version 1.43.3 or later, which patches these exploits. The software supports automatic updates, but manual installation is also possible. Users should additionally consider restricting Plex server access to local networks only, employ reverse proxies instead of default open internet ports, use official and secure Plex applications, and maintain strong, unique passwords.

Given the active exploitation activity in the wild, immediate patching is crucial for all Plex users. The original Plex security team has not yet provided further comments on the matter.

Detailed technical information and proof-of-concept exploit code have been shared publicly by researchers on platforms such as GitHub, emphasizing the need for rapid remediation. Overall, this incident highlights the evolving sophistication of attacks against popular media server software, underlining the importance of regular updates and robust security configurations.