Plex2Shell exploited within a day

A honeypot built to imitate a vulnerable Plex Media Server started getting scanned within a day of a working exploit chain going public, and some of those probes turned into successful infections. The payloads were a cryptominer and residential proxy software.

Plex fixed four vulnerabilities at the start of last month. Three weeks later, published CVE designations revealed five, one of them rated 8.6 out of 10. Last week a researcher demonstrated an exploit that chains four of them together into remote code execution on the host running a vulnerable version, and named it Plex2Shell.

Those published details gave a second researcher enough to stand up a honeypot and track exploitation attempts in the wild. Scanning of the fake server started almost immediately, and before long some attempts succeeded in infecting the simulated device.

The cryptominer does what cryptominers do, burning the compromised box’s CPU to mine coins into a wallet the attacker controls. The residential proxy software is the more interesting half. It turns the infected machine into a relay: someone connects through the box and routes their traffic out from it, so activity that is often illegal appears to come from a residential IP rather than a data-centre range.

That residential address is what makes the target attractive. “Plex may be hosted on residential IP [sic] and I think threat actors would love to have residential IP proxy to access corporate VPNs and emails,” the second researcher wrote. Plex servers tend to sit on home connections, exactly the kind of address that lets proxied traffic blend in.

If you run a Plex Media Server, update to a fixed version now. The chain is public, the scanning is automated, and a honeypot found live infections within a day of release. An internet-facing server still running the vulnerable version is already being scanned and hit.