PSA: Patch your Plex media server before someone hacks it
A researcher says attacks chaining 4 vulnerabilities is hacking unpatched boxes.
A researcher says attacks chaining 4 vulnerabilities is hacking unpatched boxes.
The short version
- Recently fixed vulnerabilities in the Plex Media Server are under active exploitation in attacks that, when successful, install malware, including cryptominers and residential proxy apps, a researcher said.
- Plex fixed four vulnerabilities at the start of last month.
- Three weeks later, published CVE designations revealed five vulnerabilities, with one of them carrying a severity rating of 8.6 out of 10.
What happened
A researcher last week revealed an exploit that chained four of them together to achieve remote code execution of the device running a vulnerable Plex version. The researcher named the chain “Plex2Shell.” “Plex may be hosted on residential IP [sic] and I think threat actors would love to have residential IP proxy to access corporate VPNs and emails,” the second researcher wrote.
Why it matters
The published exploit chain was part of a proof-of-concept attack that the first researcher included when submitting a bug report to Plex.
Summary by Nerd News Network. Read the full article at Ars Technica via the links above and below.