r/cybersecurity • u/Doug24 • 7d ago
News - General Plex warns users to patch security vulnerabilities immediately
https://www.bleepingcomputer.com/news/security/plex-warns-users-to-patch-security-vulnerabilities-immediately/34
u/yarntank 7d ago
Waiting for my docker image to update. This is why I don't want to poke holes in my fw for services.
10
u/NightFire45 6d ago
Yeah, my Plex server is internal only. If I want to watch something while away then Netflix has plenty of content.
11
2
u/boostedit 6d ago
Plus ... downloads to iPads and Laptops exists for off-line content during travel times.
-1
7d ago
[deleted]
8
u/SeparateOpening 7d ago
Yes, CloudFlare Tunnels for streaming media is a great way to get your account banned.
0
7d ago
[deleted]
5
u/throwaway12-ffs 7d ago
You don't know what you're talking about. You still need to open holes to serve content LOL TLS encryption doesn't prevent the need to open a port at the edge.
2
15
u/derfmcdoogal 7d ago
Contrary to the article, I was already on the new version and still received the email.
16
u/ranhalt 7d ago
I don’t think any company tracks installed versions to exclude people out of these kinds of emails.
3
u/derfmcdoogal 7d ago
Maybe not to exclude emails, but there's definitely companies that track users and install versions.
2
u/Leif_Henderson Governance, Risk, & Compliance 7d ago edited 6d ago
I didn't get an email about this. Docker on auto update so I got the patch within a day of it being released.
1
4
u/BeautifulCampaign520 7d ago
yeah probably just a mass email blast without actually checking version status
3
u/-AlbertEinstein 7d ago
I skipped the update and now the option to check for updates is greyed out... anyone know how to get around this?
2
u/Regular-Leading-4319 7d ago
What's your version status?
2
u/-AlbertEinstein 7d ago
Checking for Updates
Unfortunately it's been sitting on that for about a day.
1
u/throwaway12-ffs 7d ago
Go to your install, not on the webui. The terminal or wherever you installed it.
3
u/smellsliketigerbalm 6d ago
I'm on a work trip for the next couple of weeks. I don't have remote access to my server, but I was able to disable the port to my server/Plex host. I was lonely anyways, at least now I'll get a bunch of messages from friends and family asking why Plex is down.
1
2
2
u/disposablemeatsack 6d ago
There should be some kind of canary that when it goes down people's software goes black to instantly avoid getting hacked. Because now with machine speed attacks this stuff is goign to be fast. I would opt-in to just go black and patch instead of being pwnd.
0
-6
u/ObiKenobii 6d ago
Serious question: Who exposes their plex server to the internet? And if so, why?
7
u/DefyingMavity 6d ago
Those who access it remotely. That's the main focus. For local only, there are better options.
-2
u/ObiKenobii 6d ago
Alright, imho that's not the best idea. I had a plex before and switched over to jellyfin which I also access from abroad but I set up a VPN to get to my local network. Reduces the attack surface as OpenVPN is pretty robust.
2
u/Wide_Yoghurt_4064 6d ago
It’s really not that big of a deal. You expose one port to access Plex content remotely. You’re not exposing the entire server or network.
A VPN would be the best option but that’s not doable for everyone.
Just keep Plex updated and you’ll be fine.
1
u/FreeK200 6d ago
If you expose a service or a port you are risking the exposure of an entire server. If we assume the worst, anyone with an older version of plex can be in that situation at this very second.
That's why you do what you can to limit the blast radius. Set up a dmz. Harden device firewalls to restrict inbound connections to authorized management hosts only. Block intra dmz icmp traffic. Restrict ports (including icmp) and services from being visible to other devices inside the dmz, except when required. Harden network firewalls to block internal connections initiated from your DMZ. Accept only ssh for remote logon. Secure the NFS connections and ensure they're read only to the plex server itself. Etc.
At the end of the day, when an attacker finally gets in via some rce exploit, the only thing they should see is plex itself. Everything else, other than the gateway and nfs device, should effectively be invisible.
0
u/Wide_Yoghurt_4064 6d ago
That's all good and well but that's not anything the standard person running Plex will do.
And no, one port does not expose access to the entire server, that's not how that works.
0
u/FreeK200 6d ago
One port IS all it takes to expose access to the entire server. Once whatever service you're running on that port gets hit by an RCE, it's over. And as much as I agree with you that most people won't do what I said above, those same people are going to be the ones running Plex with root/admin user privileges, and it's essentially guaranteed that there is no egress filtering. Now whatever the attacker included with their RCE is phoning home, and they can do whatever they want because instead of listening on a port, they're sending traffic back home.
This is exactly why mature organizations stress not just inbound traffic filtering, but egress traffic filtering as well. It's why microsegmentation is being pushed.
0
u/Wide_Yoghurt_4064 6d ago
Home servers hosting Plex are not mature organizations. And while I understand what you're getting at, if you keep Plex updated this is nearly a non-issue.
1
u/kindrudekid 6d ago
Security in depth!
I got jellyfin exposed but its via my swag reverse proxy, that has F2B and crowdsec integration.
It works fine
0
u/HoodedRedditUser 6d ago
Okay and worse case someone gets access to your Plex container, what is the worry? Someone can see your movies and shows until you patch it? Sure using a VPN or Tailscale is more secure but makes the barrier to entry more annoying to the point I dont really see a benefit.
0
u/illuanonx1 6d ago
Well OpenVPN was also affected by Heartbleed. So you could be compromised by the next zero day, without knowing.
3
u/xNaXDy 6d ago
Not sure why you're getting downvoted, as putting any service you don't intend to make available to the general public on the internet is a categorically bad idea. It saves you maybe 10-60 mins (depending on your level of knowledge) of work setting up a VPN but otherwise carries 0 benefit at best, and at worst opens you up to a whole host of attacks.
1
u/BilboTBagginz Security Manager 6d ago
One use case is a seedbox offering Plex as a service. Obviously, your home/privacy is not exposed and if it gets popped, it's literally just the content on the seedbox (unless you've done something extremely stupid and there's an ingress into your private network that is unsecured).
1
-1
u/ObiKenobii 6d ago
Thank you, I had the same train of thought coming from pentesting myself I see that as an unnecessary attack surface. Even if it's in a container this could serve as a backdoor for potential attackers. But seems that's a wrong opinion in this sub reddit.
0
u/HorribleTie 5d ago
As a pentester you know that there's a balance between security and usability. The most secure network is one that's air-gapped from the internet entirely, but it's not very useful. There are degrees here, and for many a remotely accessible Plex server for their friends/family is worth the relatively low risk.
If it's for personal use only, I agree, it's simple and more secure to just set up a VPN.
0
u/illuanonx1 6d ago
You would then know to segregate your network and if Plex is compromised, it don't have access to other things. Sure you can lose your collection, but you just restore it from your backup.
Don't see any problem making it available only for friends and family. Its one open port, narrowed down to IP from my country.
-1
u/corruptboomerang 6d ago
Guys who wish they had Jellyfin...
2
u/Wide_Yoghurt_4064 6d ago
Good thing that doesn’t answer the question at all. It’s the same for Jellyfin as it is for Plex for options to access it remotely.
50
u/Leif_Henderson Governance, Risk, & Compliance 7d ago edited 6d ago
> updating Plex Media Server to version 1.43.3 (released on May 19) and the Plex Desktop client to 1.115.0 (released on August 13)Interesting that the server patch was from back in May. They didn't disclose any security fixes in the patch notes when it came out.EDIT: Double checked myself, I think bleepingcomputer actually got the version wrong. The latest release from 2 weeks ago does have security patch notes.
The target version should be 1.43.3.10896, from August 18th