Hackers Exploit Plex Flaws To Turn Media Servers Into Zombie PCs, Update ASAP

Plex users received an urgent security warning two months ago that urged them to update to the latest version of the self-hosted media streaming solution after the discovery of several vulnerabilities. At the time, there wasn’t much information regarding the nature of the security flaws, but the researcher who discovered them has released the details and that knowledge is now being used to exploit out-of-date systems in the wild.

In an in-depth blog post, code-zm shared how an attacker could gain complete control over a system with Plex installed without even having to be authenticated. All an attacker needs to do is target a system with an old version of Plex with a junk token, and once connected to the server, wait for it to provide a loopback URL. With this opening, it’s possible to pivot to an unguarded API and combine it with the loopback to attack Plex plugins.

Plex has a number of plugins that serve several functions, one of them being an agent that gets metadata for TV shows and movies. Part of this metadata fetching process involves utilizing the administrator’s token to make the request, which an attacker can exploit to trigger a request and send all of the data, including the token, to a server they control. Having this token gives them the keys to the castle, including delivering and executing code remotely.

It didn’t take long for hackers to begin using this information to compromise systems. Some users have reported seeing a crypto miner installed while others say their computers have been commandeered as part of DDOS activity.

If you’re running an older version of Plex you need to update as soon as possible. However, before doing so, check for any suspicious processes that might be running. Users are reporting seeing processes such as “myawersomeproxy,” “mylovelyminer,” and “x12345” running on their compromised systems.

If you spot any of these, or any other suspicious processes, then you need to completely wipe your system and start from scratch, then install the latest version of Plex.