What happened
A critical vulnerability has been identified in Plex Media Server, related to an improper neutralization of encoded URI schemes in a web page. This weakness allows an attacker to execute malicious functions within the affected application by calling other plugins' functions and supplying arbitrary parameters. The vulnerability has been actively exploited in the wild, indicating that malicious actors are currently leveraging this flaw to compromise vulnerable systems. The exploitation pathway involves the attacker manipulating web requests to the server, exploiting the improperly sanitized URI schemes to invoke malicious plugin functions. This can result in unauthorized actions or further compromise of the affected system.
Who is affected
Organisations running affected versions of Plex Media Server are at risk. Any deployments exposed to the internet or accessible via untrusted networks are particularly vulnerable. This includes instances where the server's web interface can be reached without appropriate protections in place. Affected environments are considered high priority for remediation due to the active exploitation and severity of the vulnerability. The impact is particularly significant for those who have not implemented the recommended mitigations or who are unable to disable the affected service immediately.
Recommended actions
- Apply mitigations strictly following vendor instructions, particularly addressing the specific exploit path involving web request handling and URI scheme processing.
- Ensure compliance with CISA’s BOD 26-04 guidance on prioritising security updates, which may include evaluating the exposure of affected assets to the internet.
- Follow CISA’s “Forensics Triage Requirements” to assist in identifying and responding to potential signs of exploitation.
- If mitigation measures are not available within the current environment, consider discontinuing use of the affected service until appropriate protections are in place.
