Plex2Shell Used to Deliver Miner and Proxy Software

A security researcher observed attackers exploiting the Plex2Shell vulnerability chain against an internet-facing Plex Media Server honeypot on October 17, delivering cryptocurrency-mining and proxy software, according to the researcher’s account. The evidence confirms activity on the controlled system but does not establish a broad campaign against production servers. Plex2Shell combines four flaws to enable remote code execution on susceptible Plex Media Server versions without an attacker logging in. The affected releases are those before version 1.43.3.10861. Plex released that fixed version in August and advised users in a September security notice to upgrade. The researcher, who runs the boredhackerblog site, said the vulnerable server was set up as a honeypot to monitor for attacks. The observed payload included an XMRig-based miner, which can use a compromised machine’s processing power to mine cryptocurrency, and a program called myawesomeproxy. The researcher identified the latter as proxy software capable of routing outside traffic through the server’s internet connection. Public technical details and proof-of-concept exploit code for the four-flaw chain appeared on...