Plex2Shell Chain: 4 Flaws Deploy Cryptominers on Unpatched Servers Without Auth
Attackers are actively exploiting a chain of four vulnerabilities in Plex Media Server to install cryptominers and proxy software on unpatched systems.
Key points
- Researchers confirmed active exploitation of the Plex2Shell chain targeting unpatched servers.
- Successful attacks deploy cryptominers and residential proxy applications on compromised devices.
- The exploit chain achieves remote code execution without requiring user authentication.
Four chained vulnerabilities in Plex Media Server are being actively exploited to install malware on unpatched systems, according to Ars Technica. The attack sequence, named Plex2Shell by the researcher who documented it, allows attackers to achieve remote code execution on devices running vulnerable versions of the media server software. This enables full control over the compromised machine without any prior authentication or login credentials from the attacker.
What is the severity of these flaws?
Plex addressed four vulnerabilities at the start of last month, according to Ars Technica. Three weeks later, published Common Vulnerabilities and Exposures designations revealed five total issues, with one carrying a severity rating of 8.6 out of 10. The exploit chain links four of these flaws together. This high severity rating indicates that the vulnerabilities are significant and require immediate attention from administrators managing these servers.
How does the exploit chain function?
The researcher who developed the proof-of-concept exploit described a complex series of steps required to breach the system, according to Ars Technica. The process begins with an unauthenticated server-side request forgery, followed by a loopback pivot. The attacker then steals a security token, delivers a payload, and finally executes that payload on the target device. This multi-stage approach bypasses standard security controls to gain full access.
What malware is being deployed?
Successful exploitation results in the installation of two specific types of malware payloads, according to Ars Technica. One payload is a cryptominer that uses the compromised device’s processing power to mine cryptocurrency for the attacker. The second payload installs residential proxy software. This software allows threat actors to route their internet traffic through the infected Plex server, masking their true location and potentially accessing corporate resources.
Why target Plex Media Server?
Researchers noted that Plex servers are often hosted on residential IP addresses, according to Ars Technica. Threat actors value these residential proxies because they can help bypass security filters and access corporate virtual private networks or email systems. The use of residential IPs makes the malicious traffic harder to distinguish from legitimate user activity, providing attackers with a stealthy entry point into other networks.
Detection notes
Security operations teams should monitor for unusual outbound connections from media servers, particularly those connecting to known cryptocurrency mining pools or proxy networks. Check for unexpected process executions or high CPU utilization on servers that should be idle. Investigate any server-side request forgery attempts in web server logs. Look for new user accounts or privilege escalations that do not match normal administrative activity. Verify that all media server instances are running the latest patched versions to prevent unauthorized code execution.
What to do and how to stay safe: Plex Media Server
- Verify that all Plex Media Server installations are updated to the latest version to patch the known vulnerabilities.
- Monitor network traffic for unexpected connections to cryptocurrency mining pools or residential proxy services.
- Review server logs for signs of unauthenticated server-side request forgery attempts or unusual process executions.
- Isolate any compromised systems from the network to prevent further lateral movement or data exfiltration.
Step-by-step guide: Patch Management Checklist: Secure Systems Without Breaking Them
General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is there a patch available for these vulnerabilities?
Yes, Plex fixed four vulnerabilities at the start of last month, according to Ars Technica.
What is the name of the exploit chain?
The researcher named the exploit chain Plex2Shell, according to Ars Technica.
Can this attack be performed without authentication?
Yes, the exploit chain achieves remote code execution without requiring user authentication, according to Ars Technica.
