Attacks on Plex servers install miners and proxies — Ars Technica

Attackers are actively exploiting recently patched vulnerabilities in Plex Media Server to infect devices with malware, including cryptocurrency miners and residential proxy software. Ars Technica reports, citing a security researcher.

A chain of four vulnerabilities

At the beginning of the previous month, Plex fixed four vulnerabilities in its media server. Three weeks later, five CVEs were disclosed, one of which received a severity score of 8.6 out of 10. A researcher published an exploit that combines four vulnerabilities and enables remote code execution on a device running a vulnerable version of Plex. He called this chain Plex2Shell.

Another researcher created a honeypot — an imitation Plex server for tracking attack attempts. Within a day, he had already recorded active scanning of such a server and later successful attempts to infect devices.

More current news is available on the UA.News Telegram channel Telegram.

Miners and proxies on infected devices

According to the researcher, one malicious component uses a device's computing resources to mine cryptocurrency, which is sent to the attacker's wallet. Another component turns an infected device into a residential proxy: users can send their internet traffic through it to the final resource while concealing its origin.

The published proof of concept involved several stages, including an unauthenticated SSRF attack, access through the loopback interface, theft of a security token, and delivery and execution of a payload. The exploit's author said he actively used artificial intelligence during development, but made the decisions on finding and prioritizing vulnerabilities independently.

Recommendations for users

Plex users are advised to make sure that version 1.43.3 is installed on the server. Updates can be configured automatically or installed manually. The safest option is to limit access to the media server to the local network without exposing it to the internet. If the server is accessible from the internet, the article advises considering the use of a reverse proxy instead of the standard port 32400, as well as using secure Plex applications and strong passwords.