RECENTLY fixed vulnerabilities in Plex Media Server are being actively exploited to install malware, researchers report. Plex fixed four vulnerabilities at the start of last month, and three weeks later CVE designations were published for five flaws, one of which carries a severity rating of 8.6 out of 10. A separate researcher disclosed an exploit chain, dubbed Plex2Shell, that chains four of the flaws to achieve remote code execution on devices running vulnerable Plex versions.
The chain was demonstrated in a proof-of-concept and later used to observe real-world attempts via a honeypot that tracked in-the-wild activity within a day of publication.
Evidence from the researchers shows attempts to exploit the chain escalated quickly from scanning to infection. So far, successful attacks install two payloads on compromised systems: a cryptominer and residential proxy software, enabling the attacker to route victim traffic through the infected box. The team notes that Plex may be hosted on residential IP addresses, which threat actors could use to access corporate VPNs and emails via proxy endpoints.
The exploit sequence involves unauthenticated SSRF, a loopback pivot, token theft, payload delivery, and execution, with AI used to help develop the chain. Plex recommends users run version 1.43.3, enable automatic updates if possible, or manually update; consider limiting exposure by keeping Plex servers on local networks, or routing traffic through a reverse proxy if internet-facing. Use secure Plex apps and strong passwords.