Plex2Shell Vulnerabilities Actively Exploited to Deploy Crypto Miners
Attackers are chaining four flaws in Plex Media Server to install cryptocurrency miners and backdoors. The exploitation follows the public release of a proof-of-concept exploit.
TL;DR
- Threat actors are exploiting a chain of four vulnerabilities dubbed Plex2Shell in Plex Media Server.
- The attack deploys cryptocurrency miners and Linux reverse proxy backdoors.
- Exploitation began shortly after a public proof-of-concept was released.
- Organizations using Plex Media Server should patch immediately.
- The vulnerabilities allow remote code execution and persistent system access.
Cybercriminals have begun actively exploiting a series of vulnerabilities in Plex Media Server, collectively known as Plex2Shell. These exploits enable attackers to remotely install cryptocurrency mining software and establish persistent backdoors on compromised systems.
Security researchers identified that the exploitation follows closely on the heels of a publicly released proof-of-concept, demonstrating how quickly threat actors can weaponize newly disclosed flaws. Organizations running unpatched versions of Plex Media Server are at immediate risk of compromise.
Vulnerability Chain Breakdown
- The Plex2Shell flaw chain consists of four distinct vulnerabilities within Plex Media Server.
- These issues were discovered and reported by a researcher known as boredhackerblog.
- When chained together, they enable full remote code execution without authentication.
- One of the vulnerabilities involves improper input sanitization leading to command injection.
- Another component allows attackers to bypass access controls and escalate privileges.
Malware Deployment and Impact
- Compromised systems are being used to mine cryptocurrency, consuming significant CPU resources.
- Attackers also install Linux reverse proxy tools to route malicious traffic through infected servers.
- This enables further attacks while masking the origin of malicious activities.
- Infected systems remain under attacker control even after initial payload delivery.
- Detection is challenging due to the legitimate nature of Plex Media Server processes.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.