Plex Media Server flaws fixed last month now exploited to install malware
Recently fixed vulnerabilities in Plex Media Server are under active exploitation, a researcher said. When the attacks succeed, they install malware, including cryptominers and residential proxy apps.
The timeline runs like this. Plex fixed four vulnerabilities at the start of last month. Three weeks later, published CVE designations revealed five vulnerabilities, one of them rated 8.6 out of 10 for severity. Last week, a researcher revealed an exploit that chained four of them together to achieve remote code execution on the device running a vulnerable Plex version. The researcher named the chain "Plex2Shell."
Those details let a separate researcher build a honeypot, a simulated Plex server, to track exploitation attempts in the wild. Within a day, the researcher began seeing active scanning of the simulated server and, eventually, successful attempts to infect devices.
So far, successful attacks install two payloads. One is a cryptominer, which uses the device to mine cryptocurrency and deposit it into a wallet controlled by the attacker. The other is residential proxy software. It lets people anonymize their Internet activity (much of it illegal) by connecting to the infected box and using it to send the user's traffic on to a final destination.
The second researcher explained why attackers might want such devices: "Plex may be hosted on residential IP [sic] and I think threat actors would love to have residential IP proxy to access corporate VPNs and emails."
Key facts
- Plex fixed four vulnerabilities in Plex Media Server at the start of last month; CVE designations published three weeks later revealed five, one rated 8.6 out of 10.
- A researcher published an exploit chaining four of the bugs for remote code execution on a vulnerable Plex device, and named it "Plex2Shell."
- A second researcher's honeypot saw active scanning within a day, followed by successful infection attempts.
- Successful attacks so far install two payloads: a cryptominer that sends mined coins to an attacker's wallet, and residential proxy software.
Why it matters
The bugs were already fixed, yet attackers moved quickly once a working exploit chain became public. Within a day of the honeypot going up, scanning began, and successful infections followed. The residential proxy payload shows a motive beyond mining: the second researcher says threat actors would value a residential IP address for reaching corporate VPNs and email.
Who it affects
Anyone running a vulnerable version of Plex Media Server. The exploit achieves remote code execution on the device hosting Plex, so the affected machine is the whole box, not just the media library. The source says Plex may be hosted on a residential IP address, which is what makes such servers attractive as proxies.
How to use it
The headline's advice is to patch. The vulnerabilities were fixed at the start of last month, so updating Plex Media Server to a current version is the step the story points to. The source gives no version number and no further mitigation steps.
How solid is it
The claim of active exploitation comes from a researcher, and the evidence is a honeypot: a simulated Plex server that drew scanning within a day and then successful infection attempts. The source does not name either researcher. It does not give CVE identifiers, and it does not say which vulnerability carries the 8.6 rating. The honeypot results describe a simulated server, and the source gives no figure for real-world victims.
Risks and caveats
The source does not say how many devices have been infected, how many Plex servers are exposed, or who the attackers are. It does not explain why the fifth vulnerability was not part of the chain. The two payloads are what attacks have installed so far, so other payloads are not ruled out. An infected box can mine cryptocurrency for the attacker or relay other people's traffic, much of it illegal, through the owner's connection.
“Plex may be hosted on residential IP [sic] and I think threat actors would love to have residential IP proxy to access corporate VPNs and emails”
— The second researcher, who built the honeypot