I have seen a bunch of posts about people getting attacked by Plex2Shell. It’s an exploit chain consisting of 4 separate CVEs (), which together allows a remote attacker to execute code on your server without authenticating. For instance to drop a crypto miner or join a DDoS botnet.

This is patched in 1.43.3.10861, which was released in August. So if you’ve patched recently you should be good… if not it’s time to do so if your server is available on the internet.

Plex release note: https://forums.plex.tv/t/plex-media-server/30447/712

Write-up: https://zmain.info/blog/plex2shell

GitHub PoC: https://github.com/code-zm/plex2shell/tree/main

Mentions:

• https://cybersecuritynews.com/plex-vulnerabilities-exploited-in-wild/
• https://www.reddit.com/r/PleX/s/zZZHLX99lA
• https://www.reddit.com/r/PleX/s/eJb0NvtCwS