Recently fixed vulnerabilities in the Plex Media Server are under active exploitation in attacks that, when successful, install malware, including cryptominers and residential proxy apps, a researcher said.

Plex fixed four vulnerabilities at the start of last month. Three weeks later, published CVE designations revealed five vulnerabilities, with one of them carrying a severity rating of 8.6 out of 10. A researcher last week revealed an exploit that chained four of them together to achieve remote code execution of the device running a vulnerable Plex version. The researcher named the chain “Plex2Shell.”

Complex exploit chain

The new details allowed a separate researcher to create a honeypot that could track attempts in the wild to exploit the vulnerability chain. Within a day, the researcher began seeing active scanning of the simulated Plex server and eventually successful attempts to infect devices. So far, successful attacks are installing two payloads. One is a cryptominer, which uses the device to mine cryptocurrency and deposit it into a wallet controlled by the attacker. The other payload is residential proxy software, which allows people to anonymize their Internet activity (much of it illegal) by connecting to the infected box and then using it to send the user’s traffic to a final destination.

“Plex may be hosted on residential IP [sic] and I think threat actors would love to have residential IP proxy to access corporate VPNs and emails,” the second researcher wrote.

The published exploit chain was part of a proof-of-concept attack that the first researcher included when submitting a bug report to Plex. The complex code completes a series of steps, including performing an unauthenticated SSRF, a loopback pivot, a security token theft, a payload delivery, and finally the execution of the payload. The bug finder said he used AI “heavily” to develop the exploit chain. Steps included:

1. Recon: Break the system into logical components. Map every path from user input to a dangerous sink.
2. Hunt: Focused vulnerability hunt per component.
3. Verify: Spawn a separate agent to try to disprove each finding. If it can’t refute the bug, it’s likely real.

“This was not a matter of telling the LLM ‘go hack Plex,’” the researcher wrote. “It was hours of iterative work, dead ends, and reprioritization. All of the judgment calls on what to look for and what to prioritize were mine. The LLM speeds this process up significantly, allowing me to stay at a higher level and simply guide the process.”

Plex representatives didn’t immediately respond to questions.

Anyone using Plex should ensure it’s running version 1.43.3. The software can be configured to install updates automatically, or users can manually download and install them. Given the active exploitation, outdated versions should be updated immediately. Beyond that, users should devote care to properly securing the media servers. The safest option is to restrict its access to local networks with no exposure to the Internet. This option prevents being able to use many useful features, though. One option when connecting a device to the open Internet is to route traffic through a reverse proxy, instead of using the default port 32400. Users should also use only secure Plex apps. And of course, strong passwords are a must.