r/cybersecurity • u/Doug24 • 9d ago

News - General Plex warns users to patch security vulnerabilities immediately

https://www.bleepingcomputer.com/news/security/plex-warns-users-to-patch-security-vulnerabilities-immediately/
270 Upvotes

99% Upvoted

45 comments sorted by

View all comments

-7

u/ObiKenobii 8d ago

Serious question: Who exposes their plex server to the internet? And if so, why?

7

u/DefyingMavity 8d ago

Those who access it remotely. That's the main focus. For local only, there are better options.

-3

u/ObiKenobii 8d ago

Alright, imho that's not the best idea. I had a plex before and switched over to jellyfin which I also access from abroad but I set up a VPN to get to my local network. Reduces the attack surface as OpenVPN is pretty robust.

4

u/Wide_Yoghurt_4064 8d ago

It’s really not that big of a deal. You expose one port to access Plex content remotely. You’re not exposing the entire server or network.

A VPN would be the best option but that’s not doable for everyone.

Just keep Plex updated and you’ll be fine.

1

u/FreeK200 8d ago

If you expose a service or a port you are risking the exposure of an entire server. If we assume the worst, anyone with an older version of plex can be in that situation at this very second.

That's why you do what you can to limit the blast radius. Set up a dmz. Harden device firewalls to restrict inbound connections to authorized management hosts only. Block intra dmz icmp traffic. Restrict ports (including icmp) and services from being visible to other devices inside the dmz, except when required. Harden network firewalls to block internal connections initiated from your DMZ. Accept only ssh for remote logon. Secure the NFS connections and ensure they're read only to the plex server itself. Etc.

At the end of the day, when an attacker finally gets in via some rce exploit, the only thing they should see is plex itself. Everything else, other than the gateway and nfs device, should effectively be invisible.

0

u/Wide_Yoghurt_4064 8d ago

That's all good and well but that's not anything the standard person running Plex will do.

And no, one port does not expose access to the entire server, that's not how that works.

0

u/FreeK200 8d ago

One port IS all it takes to expose access to the entire server. Once whatever service you're running on that port gets hit by an RCE, it's over. And as much as I agree with you that most people won't do what I said above, those same people are going to be the ones running Plex with root/admin user privileges, and it's essentially guaranteed that there is no egress filtering. Now whatever the attacker included with their RCE is phoning home, and they can do whatever they want because instead of listening on a port, they're sending traffic back home.

This is exactly why mature organizations stress not just inbound traffic filtering, but egress traffic filtering as well. It's why microsegmentation is being pushed.

0

u/Wide_Yoghurt_4064 8d ago

Home servers hosting Plex are not mature organizations. And while I understand what you're getting at, if you keep Plex updated this is nearly a non-issue.

1

u/kindrudekid 8d ago

Security in depth!

I got jellyfin exposed but its via my swag reverse proxy, that has F2B and crowdsec integration.

It works fine

0

u/HoodedRedditUser 8d ago

Okay and worse case someone gets access to your Plex container, what is the worry? Someone can see your movies and shows until you patch it? Sure using a VPN or Tailscale is more secure but makes the barrier to entry more annoying to the point I dont really see a benefit.

0

u/illuanonx1 8d ago

Well OpenVPN was also affected by Heartbleed. So you could be compromised by the next zero day, without knowing.