DEV Community

Anoymask
Anoymask

Posted on

Plex2Shell: Four-Vulnerability Chain Exploited the Day After PoC Release to Deploy Miners and Residential Proxies

#security #threatintel

1. Overview

2. Executive Summary

The Plex2Shell exploit chain combines unauthenticated server-side request forgery (SSRF), internal agent access, owner token theft, and file writing to the Codecs directory to achieve unauthenticated remote code execution (RCE). The chain has been exploited to deploy XMRig-based miners and residential IP proxy software.

3. Attack Flow

Four-Stage Plex2Shell Chain

  1. Exploits an unauthenticated SSRF (CVE-2026-96652) to forward requests to the Plex server's own loopback endpoint.
  2. Reaches the internal agent feature (CVE-2026-96654) via loopback to obtain the server owner's administrator token (CVE-2026-96655).
  3. Uses the acquired token to abuse transcoder settings (CVE-2026-96656) and write arbitrary files to the Codecs directory.
  4. The Plex process loads the written shared library and executes arbitrary code with service account privileges.
  5. The attacker downloads and runs a cryptocurrency miner and residential IP proxy software.
Stage CVE Number Abused Feature / Endpoint Role in Attack Chain
Stage 1 CVE-2026-96652 /player/timeline/subscribe (Unauthenticated SSRF) Directs external requests to Plex's own loopback environment
Stage 2 CVE-2026-96654 Loopback-restricted internal agent feature Invokes internal functions that are normally not directly accessible from outside the server
Stage 3 CVE-2026-96655 Server owner administrator token exposure Steals the authentication token required for administrative setting changes
Stage 4 CVE-2026-96656 Arbitrary file write via transcoder settings Places a malicious .so/.dll file under Codecs to achieve RCE with process privileges

4. Attacker Position and Prerequisites

  • An unauthenticated remote attacker with network reachability to the Plex endpoint exposed on TCP port 32400 via the internet.

5. Visibility for Victims and Administrators

Victim Perspective

  • Even without noticeable anomalies during media streaming, hosts may experience increased CPU load and higher network bandwidth consumption.

Administrator Perspective

  • Indicators include suspicious child processes spawned by the Plex process, unknown .so or .dll files within the Codecs folder, network traffic to proxystream.st, and processes named myawesomeproxy, mylovelyminer, or x12345.

6. Success and Failure Conditions

Success Conditions

  • A server running Plex Media Server earlier than 1.43.3.10861 is directly reachable from the internet.
  • The four-vulnerability chain successfully achieves owner token acquisition and arbitrary file writing to the Codecs directory.

Target Scope

Plex Media Server 1.43.2 and earlier.

Failure Conditions and Defensive Branches

  • Exploitation can be prevented by updating to version 1.43.3.10861 or later and disabling unnecessary remote access features or port forwarding.
  • However, if the server was exposed to the internet before the update, applying the patch alone does not remove payloads or persistence mechanisms that have already been deployed.

Remediation Level

Plex Media Server 1.43.3.10861 or later.

7. What Happens Upon Success

  • Arbitrary code execution with Plex service account privileges.
  • Unauthorized consumption of computing resources via cryptocurrency mining.
  • Conversion of residential or organizational IP addresses into residential proxies, alongside the potential exposure of shared folders and credentials accessible from the affected service account.

8. Observable Logs

The following items are investigation candidates. Availability depends on products, permissions, and log configuration/retention policies. Absence of logs does not prove the absence of a compromise.

  • Email: Inference: This attack does not originate from email.
  • Proxy/SWG/DNS: Look for outbound traffic from the Plex process to destinations such as 217.60.194[.]116 and proxystream[.]st.
  • Endpoint/EDR: Check for unknown child processes spawned by Plex Media Server, execution of myawesomeproxy, mylovelyminer, or x12345, and suspicious .so/.dll files under the Codecs directory.
  • Identity/IdP: Check for unauthorized use of owner tokens or unknown sessions and devices associated with the Plex account.
  • SaaS/Cloud: Verify the runtime image versions, volume mount ranges, and secret access history on NAS or container platforms.
  • Network: Correlate requests heading from /player/timeline/subscribe to the loopback or internal agent with subsequent payload retrieval and C2 traffic.

9. Scope of Compromise Verification

Subsequent Compromise Confirmed

  • Scope: Public observations targeting unpatched Plex servers exposed to the internet. Specific public IOCs are limited to those identified in the reported honeypot.
  • Basis: Public Information: Official Plex advisories confirm widespread active exploitation along with the deployment of miners and proxy software, and independent honeypot observations also confirmed payload execution.

Evaluation Criteria for Your Organization

  • Distinguish between contact, execution, information access, and subsequent compromise; do not assume unverified success based on a single alert.

10. Investigation Playbook

  • Investigation Starting Point: Begin with the presence of older, internet-exposed versions, suspicious child processes spawned by Plex, high CPU utilization, and proxy traffic.
  • Initial Checks: Verify the running version, remote access and port forwarding settings, the duration of internet exposure, and the execution privileges and mounted shared folders of the Plex service.
  • Terminal/Server Investigation: Preserve the Codecs folder, Preferences.xml, process trees, downloaded payloads, and container or NAS logs.
  • Authentication/Cloud Investigation: Check Plex tokens and sessions, credentials on the same host, and whether access to mounted shared storage occurred.
  • Subsequent Actions: Expand the investigation scope to determine if additional payloads aside from miners and proxies exist, if there is lateral movement into the internal network, or if unauthorized connections were made to third parties via compromised proxy IPs.
  • Containment: Stop external exposure and update to version 1.43.3.10861 or later. If there are signs of compromise, or if compromise cannot be ruled out, preserve evidence and rebuild from a clean installation rather than reusing the old data directory. Because rebuilding may result in the loss of library configurations, plan carefully by separating media files from configuration and evidentiary data.
  • Classification Categories: Categorize incidents by stage: scan contact, exploit chain reachability, RCE establishment, payload execution, and subsequent proxy abuse.

11. Defense and Detection Ideas

  • Single Event: Detect the creation of new .so/.dll files in the Codecs directory by the Plex process.
  • Timeline Correlation: Correlate the timeline of SSRF -> owner token retrieval -> Codecs write -> Plex child process launch -> external payload retrieval.
  • Threat Hunting: Hunt for myawesomeproxy, mylovelyminer, x12345, proxystream.st, and IOCs documented in the public honeypot report.
  • Log Limitations: While official Plex advisories confirm widespread exploitation, specific public IOCs are based solely on single-honeypot observations and do not cover all campaign destinations.
  • Priority Mitigations: Prioritize immediate updates, reduce unnecessary remote access exposures, monitor integrity under the Codecs path, and enforce the principle of least privilege for service accounts.

12. Facts / Inference / Hypothesis

Facts

  • CVE-2026-96652 is an unauthenticated SSRF vulnerability in the player timeline endpoint.
  • CVE-2026-96654 represents internal agent access via loopback, CVE-2026-96655 is the exposure of the owner administrator token, and CVE-2026-96656 is arbitrary file write to the Codecs directory via transcoder settings.
  • Chaining these four vulnerabilities together achieves unauthenticated remote code execution (RCE) with the privileges of the Plex Media Server process.
  • Plex Media Server version 1.43.3.10861 and later are not affected, and a public PoC (Plex2Shell) was released on October 16, 2026.
  • Official Plex advisories confirmed active and widespread exploitation targeting unpatched servers exposed to the internet, distributing miners and proxy software.
  • An independent honeypot recorded exploit attempts from sources such as 45.194.92.222 on October 17, payload retrieval from 217.60.194.116, and the execution of myawesomeproxy and XMRig.

Inference

  • Because published IOCs are biased toward single-honeypot observations, the absence of known IOCs must not be used as proof of safety; assessments should rely instead on Plex child process creation, file generation under Codecs, and outward communication activity.

Hypothesis

No additional hypotheses. Unconfirmed items are documented under "Unknowns and Additional Investigation."

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1190 Exploit Public-Facing Application high Chained four vulnerabilities against an internet-exposed Plex server to execute unauthenticated RCE. Definition
T1105 Ingress Tool Transfer high Payload downloads from external IPs were confirmed in a honeypot environment. Definition
T1496.001 Resource Hijacking: Compute Hijacking high Execution of XMRig cryptocurrency miners was observed in the reported honeypot. Definition
T1496.002 Resource Hijacking: Bandwidth Hijacking high Operation of myawesomeproxy and distribution of proxy software utilizing victim bandwidth were reported. This mapping does not confirm the relay of existing C2 communications. Definition

14. Unknowns and Additional Investigation

  • The total number of compromised servers worldwide, the relationships between individual threat actor groups, the specifics of subsequent abuse via proxied connections, and the existence of variants beyond the public PoC remain unknown.

15. Impact on SOCs and Organizations

Plex servers exposed to the internet in home environments, corporate test labs, and NAS devices are targeted. Priority should be given not only to CPU resource exhaustion caused by miners, but also to the risk of residential and corporate IP addresses being turned into proxies and used as stepping stones for attacks against other organizations.

16. Summary by Target Audience

  • For SOCs: Correlate Plex timeline SSRF activity, file creation in the Codecs directory, unknown child processes, traffic to proxystream.st, and high CPU utilization.
  • For Administrators: Immediately update to version 1.43.3.10861 or later. If the server was exposed to the internet unpatched, assume compromise, perform a clean rebuild, and rotate associated credentials.
  • For Users: If there are signs of compromise on managed servers, or if compromise cannot be ruled out, coordinate with administrators to sign out all devices from your Plex account and change your password.

Top comments (0)