CISA says attackers are chaining four Plex Media Server flaws to take over home servers
BleepingComputer lists the four CVEs, the fixed version and the timeline from disclosure to attacks.
CISA warned on October 21 that attackers are actively exploiting four vulnerabilities in Plex Media Server, the popular software people use to stream their own movies, music and photos. Chained together as "Plex2Shell," they let an attacker obtain the owner's admin token and run code with elevated privileges, BleepingComputer reports.
Researcher Zach Main reported the flaws to Plex on July 27, published technical details on October 16 and a proof-of-concept exploit three days later. Reports of exploitation began on October 17, at first against Plex honeypots to install a cryptominer. The researcher rates the full chain 9.8 out of 10.
Plex Media Server versions before 1.43.3.10861, released August 4, are affected. CISA gave federal agencies until October 23 to patch. In the same update CISA added exploited flaws in Siemens Software Center and the SiteGuard Server Edition web application firewall to its catalog.
-
Server Side Request Forgery
After exploring CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers, the bug class at the start of the chain is explained in Server Side Request Forgery.
OWASP explains server-side request forgery, the class of bug behind two of the four Plex flaws, in which a server is tricked into making requests on an attacker's behalf.
OWASP · Wade · 5 min
0