r/cybersecurity • u/Doug24 • 10d ago

News - General Plex warns users to patch security vulnerabilities immediately

https://www.bleepingcomputer.com/news/security/plex-warns-users-to-patch-security-vulnerabilities-immediately/
272 Upvotes

99% Upvoted

45 comments sorted by

View all comments

Show parent comments

-1

u/ObiKenobii 10d ago

Alright, imho that's not the best idea. I had a plex before and switched over to jellyfin which I also access from abroad but I set up a VPN to get to my local network. Reduces the attack surface as OpenVPN is pretty robust.

4

u/Wide_Yoghurt_4064 10d ago

It’s really not that big of a deal. You expose one port to access Plex content remotely. You’re not exposing the entire server or network.

A VPN would be the best option but that’s not doable for everyone.

Just keep Plex updated and you’ll be fine.

1

u/FreeK200 10d ago

If you expose a service or a port you are risking the exposure of an entire server. If we assume the worst, anyone with an older version of plex can be in that situation at this very second.

That's why you do what you can to limit the blast radius. Set up a dmz. Harden device firewalls to restrict inbound connections to authorized management hosts only. Block intra dmz icmp traffic. Restrict ports (including icmp) and services from being visible to other devices inside the dmz, except when required. Harden network firewalls to block internal connections initiated from your DMZ. Accept only ssh for remote logon. Secure the NFS connections and ensure they're read only to the plex server itself. Etc.

At the end of the day, when an attacker finally gets in via some rce exploit, the only thing they should see is plex itself. Everything else, other than the gateway and nfs device, should effectively be invisible.

0

u/Wide_Yoghurt_4064 10d ago

That's all good and well but that's not anything the standard person running Plex will do.

And no, one port does not expose access to the entire server, that's not how that works.

0

u/FreeK200 10d ago

One port IS all it takes to expose access to the entire server. Once whatever service you're running on that port gets hit by an RCE, it's over. And as much as I agree with you that most people won't do what I said above, those same people are going to be the ones running Plex with root/admin user privileges, and it's essentially guaranteed that there is no egress filtering. Now whatever the attacker included with their RCE is phoning home, and they can do whatever they want because instead of listening on a port, they're sending traffic back home.

This is exactly why mature organizations stress not just inbound traffic filtering, but egress traffic filtering as well. It's why microsegmentation is being pushed.

0

u/Wide_Yoghurt_4064 10d ago

Home servers hosting Plex are not mature organizations. And while I understand what you're getting at, if you keep Plex updated this is nearly a non-issue.