Plex Media Server flaws are being actively exploited to install malware
Admins running affected Plex servers need to treat the patched bugs as in-use, not theoretical, after exploit activity moved quickly from scanning to infection attempts.
Security researchers say attackers are actively exploiting recently patched flaws in Plex Media Server, and successful intrusions are now dropping either cryptominers or residential proxy software onto vulnerable systems. Plex had already fixed four bugs at the start of last month, and later CVE listings expanded that set to five, including one rated 8.6 out of 10. Last week, a researcher showed how four of the issues could be chained into remote code execution on a host running an affected Plex release, and labeled the chain "Plex2Shell." A separate researcher then built a honeypot and saw scanning within a day, followed by real infection attempts.
Why it matters
This means the risk is no longer limited to a proof of concept. People running vulnerable Plex Media Server installs can face malware installation, and the public exploit chain shows how multiple flaws can be combined to reach remote code execution. The rapid shift from scanning to infection attempts suggests exposed systems may be targeted soon after they are found.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.
Sources
- Ars Technica