Hackers Exploit Plex Flaws To Turn Media Servers Into Zombie PCs, Update ASAP
Plex users received an urgent security warning two months ago that urged them to update to the latest version of the self-hosted media streaming solution after the discovery of several vulnerabilities. At the time, there wasn’t much information regarding the nature of the security flaws, but the researcher who discovered them has released the details and that knowledge is now being used to exploit out-of-date systems in the wild.
In an in-depth blog post, code-zm shared how an attacker could gain complete control over a system with Plex installed without even having to be authenticated. All an attacker needs to do is target a system with an old version of Plex with a junk token, and once connected to the server, wait for it to provide a loopback URL. With this opening, it’s possible to pivot to an unguarded API and combine it with the loopback to attack Plex plugins.
...
Copyright of this story solely belongs to hothardware.com. To see the full text click HERE
