DEV Community

jeffrey
jeffrey

Posted on

Detecting exploitation of the Plex timeline SSRF in server and network telemetry

#cybersecurity #infosec #security

Detecting exploitation of the Plex timeline SSRF in server and network telemetry

Patching CVE-2026-96652 closes the path that lets a caller force Plex Media Server to issue an outbound POST. Between the advisory and the upgrade there is a window where detection is the only control available. The flaw's mechanics show where to look. First a request to one media endpoint, then an HTTP request leaving the server towards an address with nothing to do with the library.

Vulnerability overview

The CNA record states that Plex Media Server before 1.43.3.10861 allows SSRF via /player/timeline and that an attacker using any X-Plex-Token value can place a full URL in the protocol parameter. CVSS v3.1 is 4.3 with AV:N/AC:L/PR:L/UI:N, CVSS v4.0 is 5.3, and the weakness is CWE-918. CISA's SSVC assessment records Exploitation as none, Automatable as no and Technical Impact as partial.

Mechanism and exploitation conditions

Two requests make up an attempt. The first arrives at the timeline endpoint carrying a protocol value that looks like an absolute URL rather than a scheme name. The second leaves the server as an HTTP POST to the attacker-chosen host. Because the second request originates from the media server, it often reaches services that never see the attacker's address.

Impact

The CNA lists low confidentiality impact and no integrity or availability impact. For detection work the useful consequence is that the flaw is quiet: nothing crashes, no file changes, and the only durable trace is a request the server made on someone else's behalf. Technical Impact rated as partial matches a primitive used to probe internal addresses.

Affected products and scope

Plex Media Server builds below 1.43.3.10861 are affected. Detection rules should cover servers reachable from untrusted networks first, then servers on flat internal networks where an outbound POST can reach management interfaces.

Exposure context

A ZoomEye query for app="Plex Media Server" returned 507,974 matching assets when this was written, which gives a sense of how much telemetry a broad internet-facing deployment produces. That figure counts product fingerprints, not vulnerable servers, and the CVE filter for CVE-2026-96652 returned no matches, so it cannot be used as a target list for this flaw.

Remediation and mitigations

Upgrade to 1.43.3.10861 or later. Until then, log the full request line and query string for /player/timeline at the reverse proxy and alert when protocol contains a scheme separator. Monitor egress from the media host for HTTP POST requests to internal ranges, and forward those logs to a collector the media server cannot write to.

References

  1. CVE-2026-96652, https://www.cve.org/CVERecord?id=CVE-2026-96652
  2. CNA record, https://cveawg.mitre.org/api/cve/CVE-2026-96652
  3. Plex release notes, https://forums.plex.tv/t/plex-media-server/30447/711
  4. CISA CSAF advisory, https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json

Top comments (0)