Cybersecurity
Plex flaws are exploited to install malware
A researcher said attackers chained recently fixed Plex Media Server flaws to gain remote code execution, and a honeypot then observed scans and infections that installed cryptominers and proxy software.
- Plex fixed four vulnerabilities in Plex Media Server at the start of last month.
- Three weeks later, published CVE listings identified five vulnerabilities in total, including one rated 8.6 out of 10.
- A researcher last week disclosed an exploit chain called Plex2Shell that chained four flaws to achieve remote code execution on a vulnerable Plex version.
- A separate researcher built a honeypot and saw scanning within a day, followed by successful infection attempts.
- Those attacks installed a cryptominer and residential proxy software, the researcher said.
Plex fixed four vulnerabilities in Plex Media Server at the start of last month. Three weeks later, published CVE designations identified five vulnerabilities, and one of them was rated 8.6 out of 10.
Last week, a researcher described an exploit chain that linked four of the flaws and allowed remote code execution on a device running a vulnerable Plex release. The researcher named that chain Plex2Shell.
A separate researcher then used the new details to set up a honeypot. Within a day, it saw scanning against the simulated server, and later it recorded successful infection attempts.
The successful attacks have so far installed two payloads, according to the researcher. One was a cryptominer, and the other was residential proxy software that routes traffic through the infected machine.
Named in this story
Companies
- Plex
- fixed four vulnerabilities in its media server software
Products and systems
- Plex Media Server
- was the software targeted in the attacks
- Plex2Shell
- was the name given to the exploit chain
How the source tells it
The article was largely sober, but it used urgency in its account of live exploitation and a moral aside about proxy software.
- urgency live-exploitation language and rapid honeypot results
- moral framing a parenthetical remark casts proxy use as often illegal