PSA: Patch your Plex media server before someone hacks it

Recently fixed vulnerabilities in the Plex Media Server are under active exploitation in attacks that, when successful, install malware, including cryptominers and residential proxy apps, a researcher said. Plex fixed four vulnerabilities at the start of last month. Three weeks later, published CVE designations revealed five vulnerabilities, with one of them carrying a severity rating of 8.6 out of 10. A researcher last week revealed an exploit that chained four of them together to achieve remote code execution of the device running a vulnerable Plex version. The researcher named the chain “Plex2Shell.”

一位研究人员表示，Plex 媒体服务器中最近修复的漏洞正遭到积极利用。攻击一旦成功，就会安装包括加密货币挖矿程序和住宅代理应用程序在内的恶意软件。Plex 在上月初修复了四个漏洞。三周后，公布的 CVE 名称显示共有五个漏洞，其中一个漏洞的严重性评级高达 8.6 分（满分 10 分）。上周，一位研究人员披露了一种利用链，通过串联其中四个漏洞，实现了在运行易受攻击 Plex 版本的设备上执行远程代码。该研究人员将此利用链命名为“Plex2Shell”。

Complex exploit chain: The new details allowed a separate researcher to create a honeypot that could track attempts in the wild to exploit the vulnerability chain. Within a day, the researcher began seeing active scanning of the simulated Plex server and eventually successful attempts to infect devices. So far, successful attacks are installing two payloads. One is a cryptominer, which uses the device to mine cryptocurrency and deposit it into a wallet controlled by the attacker. The other payload is residential proxy software, which allows people to anonymize their Internet activity (much of it illegal) by connecting to the infected box and then using it to send the user’s traffic to a final destination.

复杂的利用链：这些新细节使另一位研究人员能够创建一个蜜罐，以追踪野外利用该漏洞链的企图。不到一天，研究人员就开始观察到对模拟 Plex 服务器的积极扫描，并最终发现了感染设备的成功尝试。到目前为止，成功的攻击会安装两个有效载荷。一个是加密货币挖矿程序，它利用设备挖掘加密货币并将其存入攻击者控制的钱包中。另一个有效载荷是住宅代理软件，它允许人们通过连接到受感染的设备，然后利用该设备将用户的流量发送到最终目的地，从而实现互联网活动的匿名化（其中许多活动是非法的）。

“Plex may be hosted on residential IP [sic] and I think threat actors would love to have residential IP proxy to access corporate VPNs and emails,” the second researcher wrote. The published exploit chain was part of a proof-of-concept attack that the first researcher included when submitting a bug report to Plex. The complex code completes a series of steps, including performing an unauthenticated SSRF, a loopback pivot, a security token theft, a payload delivery, and finally the execution of the payload. The bug finder said he used AI “heavily” to develop the exploit chain.

第二位研究人员写道：“Plex 可能托管在住宅 IP 上，我认为威胁行为者会非常乐意拥有住宅 IP 代理来访问企业 VPN 和电子邮件。”已发布的利用链是第一位研究人员在向 Plex 提交漏洞报告时包含的概念验证攻击的一部分。这段复杂的代码完成了一系列步骤，包括执行未经身份验证的 SSRF、回环枢轴（loopback pivot）、安全令牌窃取、有效载荷交付，最后是执行有效载荷。该漏洞发现者表示，他在开发此利用链时“大量”使用了人工智能。

“This was not a matter of telling the LLM ‘go hack Plex,’” the researcher wrote. “It was hours of iterative work, dead ends, and reprioritization. All of the judgment calls on what to look for and what to prioritize were mine. The LLM speeds this process up significantly, allowing me to stay at a higher level and simply guide the process.” Plex representatives didn’t immediately respond to questions. Anyone using Plex should ensure it’s running version 1.43.3. The software can be configured to install updates automatically, or users can manually download and install them. Given the active exploitation, outdated versions should be updated immediately.

“这并不是告诉大语言模型‘去黑掉 Plex’那么简单，”该研究人员写道。“这是数小时的迭代工作、死胡同和重新确定优先级的过程。所有关于寻找什么以及优先处理什么的判断都是我做出的。大语言模型显著加快了这一过程，使我能够保持在更高的层面，只需引导整个流程即可。”Plex 的代表没有立即回应置评请求。任何使用 Plex 的人都应确保其运行的是 1.43.3 版本。该软件可以配置为自动安装更新，用户也可以手动下载并安装。鉴于目前正处于活跃利用期，过时的版本应立即更新。

Beyond that, users should devote care to properly securing the media servers. The safest option is to restrict its access to local networks with no exposure to the Internet. This option prevents being able to use many useful features, though. One option when connecting a device to the open Internet is to route traffic through a reverse proxy, instead of using the default port 32400. Users should also use only secure Plex apps. And of course, strong passwords are a must.

此外，用户应注意妥善保护媒体服务器。最安全的选择是将访问权限限制在本地网络，且不暴露在互联网上。不过，此选项会限制许多有用功能的使用。在将设备连接到开放互联网时，一种选择是通过反向代理路由流量，而不是使用默认的 32400 端口。用户还应仅使用安全的 Plex 应用程序。当然，强密码是必不可少的。