Plex vulnerabilities being exploited in the wild to drop a cryptominer

Original Article ↗ Hacker News Discussion ↗

Newly exploited vulnerabilities in older versions of Plex Media Server are being used to install cryptominers and other malware on internet-exposed home servers, often saturating CPU and rendering systems unusable. Commenters highlight how Plex’s design and recommendations encourage remote access over the open internet, while patching and auto-update gaps—especially on NAS platforms and containers—leave many instances lagging behind security fixes. Many advocate moving self-hosted media servers behind VPNs like Tailscale, hardening systems by disabling tools like curl/wget or mounting /tmp with noexec, or switching to alternatives such as Jellyfin to reduce attack surface and dependence on Plex’s ecosystem.

Vulnerability & Exploit Details

  • Exploit targets older Plex Media Server; fix shipped in 1.43.3.10861 (Aug). Anything older is vulnerable.
  • Exploit chain (“Plex2Shell”) combines multiple CVEs; some stages are criticized as particularly poor security design (e.g., header existence checks without validation, localhost URL checks based only on string prefix).
  • Only internet-exposed Plex instances are affected; users whose servers are not reachable from outside their LAN are considered safe for this issue but are still advised to patch.

Remote Access vs VPN (Tailscale, etc.)

  • Many run Plex directly on the public internet because:
    • It’s the default/intended Plex use case for remote streaming and sharing.
    • Nontechnical friends/family and random devices (smart TVs, sticks) won’t reliably use VPNs.
  • Others strongly argue Plex (and similar self-hosted apps) should only be exposed via VPN (WireGuard/Tailscale/netbird) or at least via reverse proxies and extra auth.
  • Several note practical friction with VPNs: single VPN slot on phones, battery drain, lack of TV apps, CGNAT issues.

Real-World Compromises

  • Multiple users report being compromised: high CPU, obvious miner processes (“MyLovelyMiner”, fake system names), Monero mining pools in configs, and in some cases additional payloads like DDoS nodes.
  • Some machines were fully up to date on Plex but lagging on OS security patches, raising uncertainty whether Plex or the OS was the entry point in those cases.

Mitigations & Hardening

  • Strong consensus: once compromised, the system should be considered untrusted; best practice is full OS reinstall, not just deleting the miner.
  • Suggested hardening:
    • Keep Plex and OS fully updated; fix broken package repos.
    • Avoid exposing Plex directly; prefer VPNs, Cloudflare tunnels, or reverse proxies (nginx/caddy, Authelia, rate limiting, fail2ban, geoblocking).
    • Remove curl/wget if not needed; mount /tmp as noexec; restrict outbound connections (e.g., per-binary firewall, blocking mining pools).
    • Use detection tools (YARA rules, decloaker, chkrootkit, unhide) to hunt for artifacts.

Plex Auto-Updates & NAS Concerns

  • Auto-update support is inconsistent:
    • Some platforms have opt‑in auto-updates.
    • Container auto-updates are described as clunky and partly defeat container immutability.
    • Synology packages in particular lag on security updates; some warn never to expose Synology services to the internet.
  • This inconsistency likely leaves many old, vulnerable Plex instances exposed.

Plex UX, Strategy, and Alternatives

  • Several users complain that Plex UX has degraded: slow, cluttered, and pushing free ad-supported TV ahead of personal libraries; some find the latest UI “unusable” on certain devices.
  • Workarounds include:
    • Alternative client apps (e.g., third-party Plex frontends, different platform clients where old UI remains).
    • Switching to Jellyfin or other servers, often fronted by VPN or reverse proxy.
    • Highly locked-down setups (ephemeral Jellyfin containers with read-only media mounts).
  • Jellyfin is praised for openness and control, though earlier versions were criticized as visually rough; some say it has improved.
  • A new entrant (Pixel Brite) is mentioned as aiming to combine low-friction remote access with generous free features.

Security Culture & Attacker Economics

  • Some dismiss cryptomining payloads as uncreative/low-value, but others stress that any foothold could be used for worse.
  • One comment notes Plex has had “small but consequential” security issues over the years, reinforcing the view that self-hosted media servers require the same defensive mindset as other internet-facing services.