Plex Media Server Flaws Exploited to Install Cryptominers, Proxy Software

Plex fixed four vulnerabilities at the start of last month, according to the report. Three weeks later, published CVE designations revealed five vulnerabilities, one of which carried a severity rating of 8.6 out of 10. Last week, a researcher disclosed an exploit that chained four of the vulnerabilities together to achieve remote code execution on a device running a vulnerable Plex version. The researcher named the chain “Plex2Shell.”

After those details were published, a separate researcher built a honeypot to track attempts to exploit the vulnerability chain in the wild, Ars Technica reported. Within a day, the researcher began seeing active scanning of the simulated Plex server and eventually observed successful attempts to infect devices.

Successful attacks so far are installing two payloads, according to the report. One is a cryptominer that uses the infected device to mine cryptocurrency and deposit it into a wallet controlled by the attacker. The other is residential proxy software, which allows people to anonymize their internet activity by connecting to the infected device and using it to send the user’s traffic to a final destination.

Ars Technica described the disclosure as a PSA to patch Plex Media Server before attackers exploit it.

Editor's Summary

Plex Media Server vulnerabilities that were recently fixed are under active exploitation, according to Ars Technica. A researcher’s honeypot observed scanning and successful infections that installed cryptominers and residential proxy software. The exploit chain, called Plex2Shell, combines four flaws to achieve remote code execution.