Plex Media Server flaws under active exploitation

Active exploitation is underway against recently fixed vulnerabilities in the Plex Media Server, with successful attacks installing malware including cryptominers and residential proxy apps, a researcher said.

Plex addressed four vulnerabilities at the start of last month. Three weeks later, published CVE designations identified five vulnerabilities, one of which carries a severity rating of 8.6 out of 10. Last week, a researcher disclosed an exploit named "Plex2Shell" that chains four of these vulnerabilities to achieve remote code execution on devices running a vulnerable Plex version.

The disclosure enabled a separate researcher to deploy a honeypot to track in-the-wild exploitation attempts. Within one day, the honeypot detected active scanning of the simulated server and subsequent successful infection attempts.

Current successful attacks install two distinct payloads. The first is a cryptominer that leverages the device to mine cryptocurrency for an attacker-controlled wallet. The second is residential proxy software, which allows users to anonymize internet activity by routing traffic through the infected device.