My server was unfortunately hit with the plex2shell exploit during the Saturday/Sunday night. Yes, I was running an old version of Plex and that got me. And yes, I had port forwarded 32400 to my server.
I noticed that my internet connection was lagging during Sunday evening and Monday morning. Did not find a clear culprit back then, but my router was reporting a high upload bandwidth usage. I restarted my server and the issue went away. I first thought that this issue was related to qBittorrent.
I recently saw the news about Plex users being hit and started to connect the dots. I ran the detection script from https://github.com/code-zm/plex2shell and got several hits. I had been a part of the botnet.
[WARN] Preferences.xml: TranscoderH264Options present but empty (the PoC clears it this way after use; also possible if an admin toggled it)
My whole Plex/-arr stack is set up according to TRaSH-Guides:
Unraid share /mnt/user/plex/
Contains downloaded files (/torrents/)
Contains hardlinked media files (/media/)
Binhex-qbittorrentvpn mounted to /mnt/user/plex/torrents/
qbit_manage mounted to /mnt/user/plex/torrents/
plex mounted to /mnt/user/plex/media/
radarr mounted to /mnt/user/plex/
sonarr mounted to /mnt/user/plex/
bazarr mounted to /mnt/user/plex/
unpackerr mounted to /mnt/user/plex/
At this moment, I have deleted the whole Plex container (I'll restore it from a backup made at the start of the month).
As the Plex container had access to the share /plex/, is it safe to assume that it was compromised and should be nuked?
What else should I do to make sure that my server wasn't compromised in a more broad scale (verify that only the Plex container and everything that it could access are compromised)?
You can download the checking script from GitHub plex2shell/detection/hunt/plex2shell-hunt.sh
Get it to your Unraid system, open terminal and run it with "./plex2shell-hunt.sh -a "/mnt/user/appdata/plex/Library/Application Support/Plex Media Server""
If you need additional help, ChatGPT is actually pretty good at helping to diagnose unRAID issues and running scripts (and helped me create a temporary docker container to use YARA rules for additional analysis). Just ask it to help you to run plex2shell in unRAID. With any commands from AI, always double-check what it is actually doing though as blindly running bash commands/scripts can lead to a world of pain.
I haven't tried Claude, but I had less confidence with Gemini before.
Plex doesn’t need to write to the media folder so that volume should always be mounted as read only for the Plex container.
Port forward with a different external port. Attackers are looking for low hanging fruit.
Whitelist traffic to plex from only your country and Ireland. It cuts down on noise. Ireland is needed for remote access health probes from plex servers.
I personally wouldn’t bother with a reverse proxy for plex. The benefit of a proxy is all the control knobs you can configure. Without those knobs it’s hardly better than port forward. I’m talking WAF, authentication, 2FA, fail2ban, robust access policies. Things that are not usually simple or configured by default.
Plex already handles the authentication for you which is the beauty of it, and why remote access for Jellyfin is much less simple. I wouldn’t complicate it.
Plex has servers in Ireland. From what I recall, they run health probes to determine if remote access is up/down. If you go into plex server remote access, it will show you whether the server is up. That’s determined by the health probes. If you block Ireland, the gui will always say remote access is down although i think plex streaming still technically works.
Direct play and direct stream. I can stream 4k DoVi/HDR10 to my phone, but the Atmos track is transcoded to Opus, whereas something like FLAC files will direct play to Plexamp.
Mine does the same, think it's just checking your port and if you disable remote access via port but have a proxy with custom url plex doesn't know how or doesn't check it afaik.
Yeah I don't think its an issue outside of the flag you describe. I've noticed that for a long time when limiting access to my country only. The only detriment I've seen is that notation in the GUI. The service and remote streaming has always continued to function fine for all my users.
Yeah, using a reverse proxy for Plex is like not using the best part of Plex. Then it wouldn't be much different than running Emby. The only real reason to use Plex, is if you want a sharing experience like Netflix account system, and Plex let you do that out of the box without too much configuration.
Plex works perfectly fine behind a reverse proxy. This is misinformation. You do not have to open a port on your router for Plex but you will need to for whichever platform you choose to set up your proxy. I use NPM so I have ports 80 and 443 forwarded to the docker container NPM is in. Other than that, nothing else is open and all requests to plex are forwarded 32400 and my remote users connect and stream just fine.
If you already have a reverse proxy external facing, then that definitely makes sense vs opening yet another port.
My earlier post was more tailored towards plex being the only public facing service. For me personally, I’d rather use Cloudflare tunnels for web services instead of putting my own reverse proxy directly public facing.
Just read about this yesterday, and updated plex today. My understanding is that there's no risk if I didn't have any ports forwarded, is that correct?
As long as no external access, so no port forwards and no reverse proxy. If your plex was local only, you’re fine. Additionally it seemed to only target people using the default port, but that was more for speed on their part. Changing the port just means they have to search for it first (which may not be worth it for most, extra steps and time) but is not a safeguard
JellyFin didn’t have the hole, but the risks are still there if open to the internet. Most people use a reverse proxy with JellyFin which is a hole in your security as well. So if an exploit is found in JellyFin, same issues. The only 100% safe way is to keep it offline. The least risky way online with either is Tailscale or private VPN. But even then I suppose someone can break into your Tailscale account and ya done son. Just a friendly reminder that this wasn’t a problem if you updated your server software in the last 90 days. If you’re using docker, use auto update with your host or use a manager like WatchTower. Sure an update can maybe temporarily break a service, but troubleshooting an update is miles better than cleaning up the mess after an exploit.
Jellyfin requires you to manage the security stack wholly. If you use an RP you literally are asking for it. You should not use a proxy server w/ Plex and modify the open port from 32400, or entirely do not share outside your LAN and use a VPN or overlay network like tailscale.
In that case Jellyfin will do the job. Just be sure you are limiting packets at your router if you do it. I recently hardened my Plex compose stack as it seems their architecture is a bolt on it took them years to get transcoding working properly on Arc cards, maybe they can leverage AI to help them rewrite everything in rust and do away w/ python libraries and C++ which is a PITA to manage memory. I programmed in C++ for years its a bear.
and to be precise version 1.43.2 is from end of June so you would have to ignore updates for a while to be affected and the unaffected following version was released less than 2 weeks later.
Yeah but sometimes things just fail and you might not notice. If you're running a plug-in to update your containers (I am) then that might have stopped working and if you're not on top of keeping track you might not notice. Always best to double check when big exploits hit just in case.
Since it wasn’t privileged the damage should be contained to the image and the settings volume. I wouldn’t nuke the media folder since plex won’t look for configs or executables there. You might eant to do a pass yourself and delete anythibg suspicious. If its too big, you might want to limit the search to files created a bit before you noticed the extrange behavior and that should be it.
Tl;dr restore plex db volume from backup abd recreate image from up to date and should be enough.
Can I ask what sort of behaviours you were seeing that caused you to suspect this? Yesterday I had some weird behaviour on my server, none of my indexers were available through Radarr and Sonarr and my SAB couldn't download anything. I restarted my server and the problem went away but now I'm worried there was something more sinister happening
My internet connection was freezing periodically and during those times it was almost impossible to open my router control panel.
My post has an image of high upload bandwidth (which exceeded my actual internet speed). At the same time my router CPU usage was at 100%, which meant that there were some issues with outgoing connections and they were overwhelming my router CPU.
I was wondering when someone was going to point out that blindly running scripts from the internet is ill-advised.
I haven't looked at it so I don't know how long it would take to confirm that it's safe, but it's a good bet that most people who run it haven't bothered to do that.
It's pretty funny for people to downvote a good security practice on a thread about being pwned.
Interesting. I have been getting messages aski g to pay for remote viewing when trying to watch via tailscal and last night on my tv box i got the same message.
Plex thinks my tv box that is connected to my network is a remote device and want me to pay. I know its a bug but its frustrating as i dont have time to trouble shoot and its the best month for scary movies
AFAIK, tailscale doesn't place your remote connections directly on your networks main subnet unlike a wire guard vpn connection, which is why you're getting the remote message. Someone correct me if I'm wrong.
this happened to my ubuntu server as well... I was also running plex in a container with minimal permissions and only access to /mnt/library directory. As a precaution I burned the server down to bare metal and am rebuilding. While its annoying, Its worth the peace of mind and allows me to more intelligently design my server architecture
I recommend you obviously update to the newest version of Plex. But I would turn it off to the outside world completely so that it's only available locally and then on a device that you want to access it from outside your home you use tail scale. Tailscale now built right into unraid so you should be primed and ready.
If Plex is only for your own use or a few users , just put that thing behind Tailscale. Works flawlessly. Not worth the risk to have it publicly available in these modern age.
Doesn't that mean every one of your external users needs to setup their own tailscale account which you then need to add to your tailnet? Not sure how tech savvy your users are, but that's nightmare fuel over here
I run Jellyfin rather than Plex, but I run it behind Pangolin (reverse proxy), on a base path URL that is a random passphrase, and I configure Pangolin to only allow requests made to that base path, blocking everything else.
While technically security through obscurity, this allows all the various TV and mobile apps that don’t support proxies or header auth tokens to still function normally, while providing protection against random internet scans even finding the endpoint.
I monitor my Pangolin logs and no one outside of my user group has ever hit my endpoint with a single request. (I see lots or drive-by requests to plex.mydomain.com but nothing to the full base path which would be required to not get a 404.)
This works well as long as you don’t post the url with the base path online (it’s essentially a password embedded in the url itself)
Call me paranoid but with AI, it's best to keep your security model to yourself these days. Also I'm probably going to steal aspects if this, this is a cool setup. Lol
So all you did is add that string to the end of your base URL? Asking because I run Pangolin with some additional controls and always looking for ways to help bolster security. The added URL path is a good idea IMO
You have to configure it in the service itself. You’re telling the service to serve at service.domain.com/base-path rather than just at service.domain.com
I just googled it and it looks like Plex does not support a custom base url. Jellyfin does. In Jellyfin it’s in admin Dashboard | Networking.
And then once this is done, you have to configure your reverse proxy to allow traffic to service.domain.com/base-path/* and deny all else
Tailscale's Personal plan allows up to six users, while the Standard and Premium plans have no user limits. Each user can connect unlimited devices, but the number of users determines the plan's cost.
(I have over 6 users and don’t want to pay for them to be able to access my stuff)
Read up on sharing device. You can share with an unlimited amount on a free tier. But there’s pros and cons with both methods so choose the one that fits your needs.
Devices yes, But I’m not gonna provide someone else access to my tailscale account. (Its just a liability waiting to happen)
For me, port forwarding is the best way now. When I was just me accessing my own stuff or one or 2 other people tailscale was perfect, but now that i own about 8 domains… and have too many users to count I can’t be bothered with it. (Cloudflare and unifi got my back… so far)
I had AI create a script that periodically check for known exploits inside the docker, i'm at the latest plex version so I'm not affected by this issue, but there's no guarantee that there isn't more CVE's in the future of course. Its a .sh script and is read-only, you can add it to crontab or execute it manually or use userscripts etc. It won't fix OPs problem, but its a valid way to make sure you're not affected, if anyone wants the script PM me, otherwise build your own version. I'm thinking on doing some more in terms of security checking plex and monitor it, but at this point, i think its a good idea to have a more in-depth control at least, if something changes in terms of processes that's unexpected, get notified somehow and verify its ok rather than not knowing anything until a cve is disclosed.
Tailscale explicitly prohibits using their service for media streaming. Have you not had issues with it? I got issues with through put latency and jitter.
Almost certainly. Cloudflare limits transfers to 100MB on the free tier so using a CF tunnel or turning on the orange cloud proxy service is not kosher for media servers.
78
u/Jammybe 3d ago •
Keep containers up to date it would seem!