Ethical Hacking News
Unpatched Plex media servers are vulnerable to a complex exploit chain that can lead to remote code execution and malware installation. A researcher has identified four vulnerabilities in the Plex Media Server and developed an attack dubbed "Plex2Shell." Users are advised to update their servers to version 1.43.3 and take additional precautions to protect their devices, including restricting access to local networks and using secure Plex apps.
Plex Media Server has a complex exploit chain that can lead to remote code execution and malware installation. The exploit chain, dubbed "Plex2Shell," involves multiple steps, including SSRF, loopback pivot, security token theft, and payload delivery. The attack can install malware, including cryptominers and residential proxy apps, which can mine cryptocurrency and anonymize Internet activity. Plex representatives have advised users to run version 1.43.3, which is the latest patched version, and to restrict access to local networks with no Internet exposure. Users can also protect their devices by routing traffic through a reverse proxy, using secure Plex apps, and using strong passwords. A recent discovery by a researcher shows that even properly configured Plex devices can be compromised if they are not updated.
The recent discovery of a complex exploit chain in Plex media servers has raised significant concerns about the security of unpatched devices. A researcher has identified four vulnerabilities in the Plex Media Server that, when chained together, can lead to remote code execution of the device running a vulnerable version. This, in turn, can result in malware installation, including cryptominers and residential proxy apps.
The exploit chain, dubbed "Plex2Shell," was discovered by a researcher who used artificial intelligence (AI) to develop the attack. The AI tool allowed the researcher to focus on high-level judgment calls, speeding up the process and enabling them to identify the vulnerabilities more efficiently. The researchers found that the attack involved a series of steps, including performing an unauthenticated SSRF, a loopback pivot, a security token theft, a payload delivery, and finally the execution of the payload.
The attack can install malware, including cryptominers and residential proxy apps, which can be used to mine cryptocurrency and anonymize Internet activity. The researcher noted that residential proxy software is particularly attractive to threat actors, as it can be used to access corporate VPNs and emails.
Plex representatives have not immediately responded to questions about the vulnerability. However, they have advised users to ensure that their Plex media servers are running version 1.43.3, which is the latest version that has been patched. Users can configure their servers to install updates automatically or manually download and install them.
To protect their devices, users are advised to restrict access to local networks with no exposure to the Internet. This can prevent being able to use many useful features, but it is the safest option. Users can also route traffic through a reverse proxy, use only secure Plex apps, and use strong passwords.
In the case of the author, who had Plex installed on their server after switching to Jellyfin, the device was compromised, and a cryptocurrency miner was installed. The researcher discovered the hack and was able to delete the files and directories owned by the Plex user, preventing the malware from spreading further.
Related Information:
https://www.ethicalhackingnews.com/articles/Unpatched-Plex-Media-Servers-Vulnerable-to-Complex-Exploit-Chain-ehn.shtml
https://arstechnica.com/security/2026/10/recently-fixed-plex-media-vulnerabilities-are-being-exploited-to-install-malware/
Published: Mon Oct 19 16:29:18 2026 by llama3.2 3B Q4_K_M
