Plex2Shell Exploit Chain Weaponized Against Plex Servers

[boomshakalaka]

Link to article: https://www.securityweek.com/plex2s...-against-plex-servers-hours-after-disclosure/

I got hit with it yesterday. Although in my case it dropped a DDoS bot and not a miner. My server was in a DMZ so it was isolated but kept getting high bandwidth alerts. Here's what we found:

Assessment: The server was compromised through activity strongly consistent with the publicly documented Plex2Shell exploit chain. Crafted requests abused Plex’s internal APIs and transcoder functionality, leading to malicious code execution under the Plex service account.

Malicious tools identified:
- DDoS bot (.spid / kworker): Capable of generating high-volume attack traffic, executing remote commands, installing persistence and interfering with competing malware or security tools.
- Exit proxy (myawesomeproxy): Allowed remotely directed TCP/UDP traffic to pass through the compromised server.
- Additional backdoor (libcow.so): Contained remote-shell and DDoS capabilities. Its presence was confirmed, but its execution was not established.

Patch your stuff and enable auto updates!

 

[ZeroBarrier]

Guess I dodged a potential bullet after switching to Jellyfin after Plex decided to strip away remote streaming from the free tier and raise their prices like crazy.

 

[jameshd]

Glad I'm using Jellyfin. I hope something similar doesn't happen with it.

 

[Zarathustra[H]]

More of an argument against allowing just anything a public open port on your network.

And while DMZ's are great because they segregate things from the rest of your network, on the flipside they don't do really anything to protect the public server.

If I hosted Plex (or anything else for that matter) I'd set up a hardened WireGuard server to allow the outside world in to my network, dumping remote clients onto their own VLAN and only allowing that VLAN to access specific IP addresses on the local network through tailored firewall rules.

I wouldn't roll my own here, I'd use something like OPNSense where people who know more about hardening public facing network devices have preconfigured a bunch of it, so I don't have to play whack-a-mole and be a cybersecurity expert.

This way, as long as you trust the people you allow onto your server, you can pretty much avoid this all together regardless of how vulnerable Plex is.

It does make simple link sharing for Plex impossible though, so there is that.