Plex2Shell Exploit Chain Weaponized Against Plex Servers

boomshakalaka

boomshakalaka

Weaksauce
Joined
Dec 18, 2007
Messages
80
Link to article: https://www.securityweek.com/plex2s...-against-plex-servers-hours-after-disclosure/

I got hit with it yesterday. Although in my case it dropped a DDoS bot and not a miner. My server was in a DMZ so it was isolated but kept getting high bandwidth alerts. Here's what we found:

Assessment: The server was compromised through activity strongly consistent with the publicly documented Plex2Shell exploit chain. Crafted requests abused Plex’s internal APIs and transcoder functionality, leading to malicious code execution under the Plex service account.

Malicious tools identified:
- DDoS bot (.spid / kworker): Capable of generating high-volume attack traffic, executing remote commands, installing persistence and interfering with competing malware or security tools.
- Exit proxy (myawesomeproxy): Allowed remotely directed TCP/UDP traffic to pass through the compromised server.
- Additional backdoor (libcow.so): Contained remote-shell and DDoS capabilities. Its presence was confirmed, but its execution was not established.

Patch your stuff and enable auto updates!
 
Guess I dodged a potential bullet after switching to Jellyfin after Plex decided to strip away remote streaming from the free tier and raise their prices like crazy.

200.gif
 
More of an argument against allowing just anything a public open port on your network.

And while DMZ's are great because they segregate things from the rest of your network, on the flipside they don't do really anything to protect the public server.

If I hosted Plex (or anything else for that matter) I'd set up a hardened WireGuard server to allow the outside world in to my network, dumping remote clients onto their own VLAN and only allowing that VLAN to access specific IP addresses on the local network through tailored firewall rules.

I wouldn't roll my own here, I'd use something like OPNSense where people who know more about hardening public facing network devices have preconfigured a bunch of it, so I don't have to play whack-a-mole and be a cybersecurity expert.

This way, as long as you trust the people you allow onto your server, you can pretty much avoid this all together regardless of how vulnerable Plex is.

It does make simple link sharing for Plex impossible though, so there is that.
 
Thanks for the notice. I immediately remoted in and updated mine.

Although the details were sparse. Didn’t say which OS was vulnerable. And it didn’t even need a user account? I put a pin on my account because of an attack a couple years ago. I gotta protect my $60 lifetime plex pass like it’s life or death.
 
I’m going to assume this only affects people with remote access enabled on their plex server?
 
zehoo said:
I’m going to assume this only affects people with remote access enabled on their plex server?
Click to expand...
I assume that is the case also.

I was one of those $45 lifetime members when I bought it I think in 2012? Use it all the time. Will have to patch it up.
 
zehoo said:
I’m going to assume this only affects people with remote access enabled on their plex server?
Click to expand...
My thought as well, I don't do remote access on my system at all. My life doesnt necessitate accessing my home computer outside of my home, and I'm more than happy with compromise of giving up the ability to watch movies while out of the house.
 
sfsuphysics said:
My thought as well, I don't do remote access on my system at all. My life doesnt necessitate accessing my home computer outside of my home, and I'm more than happy with compromise of giving up the ability to watch movies while out of the house.
Click to expand...

For me it's music - I use Plex to manage my music and use Plexamp all the time - driving, grocery shopping, etc

But I'm behind CGNAT and have to use Plex Relay anyway (limited to 2mbps, but more than enough for my AAC music tracks) - so I'm not worried about some bad actor 'out there' finding me that much - more gonna rely on me screwing up and installing/clicking something I shouldn't with how my setup is - I'll take that risk
 
sfsuphysics said:
My thought as well, I don't do remote access on my system at all. My life doesnt necessitate accessing my home computer outside of my home, and I'm more than happy with compromise of giving up the ability to watch movies while out of the house.
Click to expand...

In the wake of affordability and politics, I have become a make shift Netflix-esque service for friends and family. All they have to do is install free plex app on their TV and send me their user name and I grant them access to my server. Then I periodically get text messages saying “can you add XYZ movie?”

I don’t charge any money or anything. And like others in here I bought the lifetime pass years ago. Absolutely love it. Price is pretty abusive now though, but only the person with the server has to pay money.
 
You must log in or register to reply here.
Back
Top