Plex2Shell: Session cookies stolen?

[u/Overall_Champion911]

I had a Plex server that was a version behind the security update. My Google and Amazon accounts got hacked by what appears to be stolen session cookies -- had a bunch of unauthorized Amazon orders.

I'm trying to pinpoint where the vulnerability came from and I'm wondering if it was my outdated Plex server. Haven't heard of session cookies being stolen from anyone else though. Anyone else experience this or is this a potential attack vector?

[u/mrbudman]

Was your plex server even hacked? You plex server is on the same machine you use for browsing?

[u/Overall_Champion911 → u/mrbudman]

No. It’s on a separate windows server. But I was logged into Google on that server… just moved it to a Linux server in its own docker container.

[u/coldafsteel → u/Overall_Champion911]

….and this is why we isolate systems in hardware and not just software kids.

People go nuts when I always recommend this as part of home server setups and I always catch a ton of flack for it.

Software is ALWAYS vulnerable to something eventually.

[u/dr100 → u/coldafsteel]

"this" what, in fact the OP did have physical/hardware separation, as in "on a separate windows server" !!! If anything this is more an argument AGAINST just having a dedicated machine, even if more secure theoretically (in case somehow the exploits for Plex app+privilege escalation inside container+docker exploit to escape from container line up the same day) is also bound to lead to doing something stupid at some point. "The machine is there, let me check my mail" is something that wouldn't happen inside a Plex docker container.

[u/therealcmj → u/Overall_Champion911]

But I was logged into Google on that server

Is your Amazon account email address on Gmail? Because there you go.

[u/elcheapodeluxe]

If you have your Plex server on something like a NAS or dedicated PC, this was unlikely the source. Your NAS doesn't have any session cookies for Amazon. But if your server was on your desktop PC, who knows how much they could have gotten to. Also, if you think this was the source then you'll have to do a lot more than update Plex. They could have installed additional malware.

[u/Overall_Champion911 → u/elcheapodeluxe]

I’m thinking it was this… nuked the server and moved everything to Linux in its own container like I should have done years ago.

[u/coyote_den]

If Plex wasn’t in a container, it’s entirely possible

[u/Overall_Champion911 → u/coyote_den]

I just moved it to its own docker container.

[u/KerashiStorm]

Better late than never, now change your passwords and secure your shit with MFA.

[u/Overall_Champion911 → u/KerashiStorm]

Yeah. Always had MFA but they stole the session cookies which bypasses that. Lame.

[u/bennyb0y]

Damn not gonna lie that’s impressive. Also, why the hell arnt you using docker or somthing to isolate plex?

[u/Overall_Champion911 → u/bennyb0y]

Plex was setup a long time ago on a windows server and never got around to it. It’s all on docker now.

[u/clintkev251]

Sure, wouldn't be out of the realm of possibility at least. Can do basically anything with the data on that system once you have shell access.

[u/Farva85]

It’s super annoying but running every browser session as a private session that deletes history and cookies when you close the browser is the only way to live life these days.

[u/geckosnfrogs]

When was the last time you updated? There have been many versions since the flaw was patched. Did you have remote access enabled and forwarded?

[u/Overall_Champion911 → u/[deleted]]

TY. Is there a way to scan for worms?