A researcher demonstrated a proof-of-concept exploit chain targeting unpatched Plex media servers, combining four vulnerabilities to achieve remote code execution. The attack begins with an unauthenticated SSRF, followed by a loopback pivot, security token theft, payload delivery, and final payload execution. The bug finder reported that AI tools were used heavily in developing the exploit chain, though the work required hours of iterative effort, dead ends, and reprioritization. Plex representatives did not immediately respond to requests for comment.
Anyone running a Plex media server should upgrade to version 1.43.3 immediately. The software supports automatic updates, or users can manually download and install the latest release. Given active exploitation of outdated versions, prompt patching is critical.
Beyond updating, users should secure their media servers. The safest approach is restricting access to local networks with no Internet exposure, though this limits many useful features. For Internet-connected setups, routing traffic through a reverse proxy instead of using the default port 32400 is recommended. Only secure Plex apps should be used, and strong passwords are essential.
Source: Ars Technica · Summarized by HeadlinesBriefing