Plex2Shell lets anyone take over an unpatched Plex server
Four chained bugs in Plex Media Server let an unauthenticated attacker run code with no login at all. Plex confirms active exploitation, and CISA added the chain to its exploited vulnerabilities list on 20 October.
Plex has confirmed that four chained vulnerabilities in Plex Media Server, nicknamed Plex2Shell, are being actively and widely exploited, letting an unauthenticated attacker run code with the privileges of the Plex process. CISA added the chain to its Known Exploited Vulnerabilities catalogue on 20 October.
The chain starts with an unauthenticated SSRF in the player timeline endpoint, moves through access to internal agent functions over loopback and disclosure of the server owner’s admin token, then ends with an arbitrary file write to the Codecs directory via transcoder preferences, enough for full code execution with no login. Versions up to and including 1.43.2 are affected; 1.43.3.10861 and later fix it. A public proof of concept went up on 16 October, and Plex says compromised servers are being used to mine cryptocurrency and run proxy software that routes other people’s traffic through the victim’s connection.
Why it matters: if you or anyone you know runs an internet-facing Plex server older than 1.43.3.10861, Plex’s own advice is to treat it as already compromised, check for unfamiliar files in the Codecs folder, reset your Plex password, and rebuild from a clean install if you find anything, not just apply the update and move on.
The caveat: the chain needs the server reachable from the internet. A Plex instance kept behind a firewall or VPN, with no port forwarded to it, isn’t exposed to this particular attack.