Plex Users Should Update to Version 1.43.3 After Exploit Chain Is Actively Used

Researchers disclosed a proof-of-concept exploit chain for Plex Media Server after including it with their bug report to Plex. The attack combines multiple steps, including unauthenticated server-side request forgery (SSRF), a loopback pivot, security-token theft, payload delivery, and payload execution.

The researchers published the exploit code in the plex2shell repository. The bug finder said he used AI “frequently” while developing the chain, but emphasized that the process still required extensive human guidance and decision-making.

How the Plex exploit chain was developed

1. Reconnaissance: Break down the system into logical components and map paths from user input to dangerous sinks.
2. Vulnerability hunting: Search each component intensively for potential security weaknesses.
3. Verification: Use separate agents to try to disprove each finding. If a suspected bug cannot be refuted, it may be genuine.
4. Chaining: Search for ways to combine individual vulnerabilities into a complete attack.

“This was not a question of telling LLMs to ‘hack the Plex,’” the researchers wrote. “It was hours of iteration, getting stuck, and reprioritizing. I made all the decisions about what to look for and what to prioritize. The LLM sped up this process a lot, allowing me to stay at a higher level and simply guide the process.”

A Plex representative did not immediately respond to questions.

Update Plex Media Server immediately

Anyone using Plex should make sure they are running version 1.43.3. Plex can be configured to install updates automatically, or users can download and install the latest version manually. Because the exploit is being actively used, older versions should be updated immediately.

Plex users should also take steps to protect their media servers. The safest option is to restrict access to local networks that are not exposed to the Internet, although this can make some useful features unavailable.

For users who need to connect Plex to the open Internet, routing traffic through a reverse proxy instead of exposing the default port 32400 can provide an additional layer of protection. Users should also follow Plex’s guidance for secure Plex connections and use strong, unique passwords. Additional guidance is available in this overview of ways to secure a Plex server before exposing it to the Internet.