350
Plex vulnerabilities being exploited in the wild to drop a cryptominer (www.boredhackerblog.info)
submitted 2 weeks ago by to c/selfhosted@lemmy.world
133 comments fedilink hide all child comments
 

The update got released over 2 months ago. So sensible admins should not be getting hit by this.

Also I use Jellyfin btw.

you are viewing a single comment's thread
view the rest of the comments
[–] 6 points 2 weeks ago* (last edited 2 weeks ago) (7 children)

Am not sensible admin. Though I did just run a backup and update. How likely am I FUBAR?

Edit: I run Plex on a dedicated proxmox VM. Theoretically I could nuke it and start over with my Plex database file. Though there's some config I'd have to do again and I don't want to

  • permalink
  • fedilink
  • source
  • hideshow 7 child comments
    •
  • [–] 10 points 2 weeks ago (6 children)

    I was also impacted, you need to remove the payload that got dumped:

    Payload: /tmp/.pxb/{curl,wget}, /tmp/.spid

    Two processes named khungtaskd / cron

    They also stole your admin token so go to the Plex UI and log out of all devices for whichever account has ownership of the instance.

    Then you can reclaim ownership and it resets the admin token.

    You should likely be fine, I didn't have any crypto miners on mine, it was just in a docker instance and didn't have access outside of it. I would be much more worried if it was a direct install on a main PC.

    Also install watch tower

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 9 points 2 weeks ago (3 children)

    Second post I’ve seen mentioning watchtower… it quit being developed about a year ago and is read-only now. I quit recommending it since it’s not being actively developed any longer.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 2 weeks ago

    I used the nicholas-fedor Watchtower branch for a while.

    I use Dockhand now (switched to it when Portainer accounced their enshittification), and that has auto-update built-in. So I no longer needed Watchtower.

    I believe Arcane also has auto-update, since Dockhand has hinted at their own enshittification a few years from now...

  • permalink
  • fedilink
  • source
  • parent