r/cybersecurity • u/Doug24 • 22h ago
News - General Plex warns users to patch security vulnerabilities immediately
https://www.bleepingcomputer.com/news/security/plex-warns-users-to-patch-security-vulnerabilities-immediately/29
u/yarntank 21h ago
Waiting for my docker image to update. This is why I don't want to poke holes in my fw for services.
7
u/NightFire45 19h ago
Yeah, my Plex server is internal only. If I want to watch something while away then Netflix has plenty of content.
10
2
u/boostedit 17h ago
Plus ... downloads to iPads and Laptops exists for off-line content during travel times.
-1
20h ago
[deleted]
7
u/SeparateOpening 20h ago
Yes, CloudFlare Tunnels for streaming media is a great way to get your account banned.
0
20h ago
[deleted]
5
u/throwaway12-ffs 20h ago
You don't know what you're talking about. You still need to open holes to serve content LOL TLS encryption doesn't prevent the need to open a port at the edge.
2
15
u/derfmcdoogal 21h ago
Contrary to the article, I was already on the new version and still received the email.
15
u/ranhalt 21h ago
I don’t think any company tracks installed versions to exclude people out of these kinds of emails.
3
u/derfmcdoogal 20h ago
Maybe not to exclude emails, but there's definitely companies that track users and install versions.
2
u/Leif_Henderson Governance, Risk, & Compliance 20h ago edited 16h ago
I didn't get an email about this. Docker on auto update so I got the patch within a day of it being released.
1
4
u/BeautifulCampaign520 21h ago
yeah probably just a mass email blast without actually checking version status
3
u/-AlbertEinstein 21h ago
I skipped the update and now the option to check for updates is greyed out... anyone know how to get around this?
2
u/Regular-Leading-4319 20h ago
What's your version status?
2
u/-AlbertEinstein 20h ago
Checking for Updates
Unfortunately it's been sitting on that for about a day.
1
u/throwaway12-ffs 20h ago
Go to your install, not on the webui. The terminal or wherever you installed it.
2
2
u/smellsliketigerbalm 16h ago
I'm on a work trip for the next couple of weeks. I don't have remote access to my server, but I was able to disable the port to my server/Plex host. I was lonely anyways, at least now I'll get a bunch of messages from friends and family asking why Plex is down.
2
u/disposablemeatsack 15h ago
There should be some kind of canary that when it goes down people's software goes black to instantly avoid getting hacked. Because now with machine speed attacks this stuff is goign to be fast. I would opt-in to just go black and patch instead of being pwnd.
-7
u/ObiKenobii 19h ago
Serious question: Who exposes their plex server to the internet? And if so, why?
6
u/DefyingMavity 19h ago
Those who access it remotely. That's the main focus. For local only, there are better options.
-2
u/ObiKenobii 19h ago
Alright, imho that's not the best idea. I had a plex before and switched over to jellyfin which I also access from abroad but I set up a VPN to get to my local network. Reduces the attack surface as OpenVPN is pretty robust.
4
u/Wide_Yoghurt_4064 18h ago
It’s really not that big of a deal. You expose one port to access Plex content remotely. You’re not exposing the entire server or network.
A VPN would be the best option but that’s not doable for everyone.
Just keep Plex updated and you’ll be fine.
1
u/FreeK200 13h ago
If you expose a service or a port you are risking the exposure of an entire server. If we assume the worst, anyone with an older version of plex can be in that situation at this very second.
That's why you do what you can to limit the blast radius. Set up a dmz. Harden device firewalls to restrict inbound connections to authorized management hosts only. Block intra dmz icmp traffic. Restrict ports (including icmp) and services from being visible to other devices inside the dmz, except when required. Harden network firewalls to block internal connections initiated from your DMZ. Accept only ssh for remote logon. Secure the NFS connections and ensure they're read only to the plex server itself. Etc.
At the end of the day, when an attacker finally gets in via some rce exploit, the only thing they should see is plex itself. Everything else, other than the gateway and nfs device, should effectively be invisible.
1
u/Wide_Yoghurt_4064 11h ago
That's all good and well but that's not anything the standard person running Plex will do.
And no, one port does not expose access to the entire server, that's not how that works.
0
u/FreeK200 10h ago
One port IS all it takes to expose access to the entire server. Once whatever service you're running on that port gets hit by an RCE, it's over. And as much as I agree with you that most people won't do what I said above, those same people are going to be the ones running Plex with root/admin user privileges, and it's essentially guaranteed that there is no egress filtering. Now whatever the attacker included with their RCE is phoning home, and they can do whatever they want because instead of listening on a port, they're sending traffic back home.
This is exactly why mature organizations stress not just inbound traffic filtering, but egress traffic filtering as well. It's why microsegmentation is being pushed.
1
u/Wide_Yoghurt_4064 8h ago
Home servers hosting Plex are not mature organizations. And while I understand what you're getting at, if you keep Plex updated this is nearly a non-issue.
1
u/kindrudekid 13h ago
Security in depth!
I got jellyfin exposed but its via my swag reverse proxy, that has F2B and crowdsec integration.
It works fine
0
u/HoodedRedditUser 17h ago
Okay and worse case someone gets access to your Plex container, what is the worry? Someone can see your movies and shows until you patch it? Sure using a VPN or Tailscale is more secure but makes the barrier to entry more annoying to the point I dont really see a benefit.
0
u/illuanonx1 16h ago
Well OpenVPN was also affected by Heartbleed. So you could be compromised by the next zero day, without knowing.
2
u/xNaXDy 17h ago
Not sure why you're getting downvoted, as putting any service you don't intend to make available to the general public on the internet is a categorically bad idea. It saves you maybe 10-60 mins (depending on your level of knowledge) of work setting up a VPN but otherwise carries 0 benefit at best, and at worst opens you up to a whole host of attacks.
1
u/BilboTBagginz Security Manager 16h ago
One use case is a seedbox offering Plex as a service. Obviously, your home/privacy is not exposed and if it gets popped, it's literally just the content on the seedbox (unless you've done something extremely stupid and there's an ingress into your private network that is unsecured).
1
-1
u/ObiKenobii 17h ago
Thank you, I had the same train of thought coming from pentesting myself I see that as an unnecessary attack surface. Even if it's in a container this could serve as a backdoor for potential attackers. But seems that's a wrong opinion in this sub reddit.
0
u/illuanonx1 16h ago
You would then know to segregate your network and if Plex is compromised, it don't have access to other things. Sure you can lose your collection, but you just restore it from your backup.
Don't see any problem making it available only for friends and family. Its one open port, narrowed down to IP from my country.
-2
u/corruptboomerang 18h ago
Guys who wish they had Jellyfin...
1
u/Wide_Yoghurt_4064 18h ago
Good thing that doesn’t answer the question at all. It’s the same for Jellyfin as it is for Plex for options to access it remotely.
44
u/Leif_Henderson Governance, Risk, & Compliance 21h ago edited 16h ago
> updating Plex Media Server to version 1.43.3 (released on May 19) and the Plex Desktop client to 1.115.0 (released on August 13)Interesting that the server patch was from back in May. They didn't disclose any security fixes in the patch notes when it came out.EDIT: Double checked myself, I think bleepingcomputer actually got the version wrong. The latest release from 2 weeks ago does have security patch notes.
The target version should be 1.43.3.10896, from August 18th