QNAP, a leading provider of storage and networking solutions, has issued a warning about the exploitation of a vulnerability chain known as Plex2Shell, which is being used to compromise Plex Media Server applications on QNAP NAS devices. This vulnerability chain, consisting of four different security flaws, was patched earlier this year.
Widespread Exploitation Begins
The exploitation of Plex2Shell started to gain momentum in mid-October when detailed technical information and proof-of-concept code were made available to the public. Attackers leveraging these vulnerabilities can execute arbitrary code on affected servers without needing valid user credentials, using the permissions associated with the Plex service.
Plex Media Server is available as a third-party app for QNAP NAS users through the official App Center. Following reports of compromised systems, QNAP has affirmed that these vulnerabilities are specific to the Plex Media Server and do not affect other QNAP operating systems such as QTS or QuTS hero.
Immediate Actions Required
In response to the threat, QNAP advises users to upgrade to Plex Media Server version 1.43.3 or newer. Devices that are internet-accessible should be treated as potentially compromised, and a reinstall of Plex is recommended. Additionally, users should promptly update their Plex and NAS passwords.
The company further advises disabling Plex Remote Access if it is not essential, and to avoid forwarding port 32400. For those who require remote access, employing a VPN is recommended. Ensuring that QTS or QuTS hero and all installed applications are up to date is also crucial for maintaining device security.
Support and Remediation
QNAP’s technical support team is actively assisting users affected by these vulnerabilities, confirming that no data loss has been reported. The QNAP Product Security Incident Response Team (PSIRT) is managing the situation, focusing on mitigating risks associated with Plex Media Server vulnerabilities.
To aid users in identifying and addressing potential compromises, QNAP has released a detailed remediation guide. This guide provides step-by-step instructions for securing systems and preventing further unauthorized access.
As cyber threats evolve, users are reminded of the importance of regular software updates and adherence to recommended security practices to safeguard their data and systems from exploitation.
