CVE-2025-69416

Executive Summary

CVE-2025-69416 is a critical information disclosure vulnerability in the Plex Media Server (PMS) backend, specifically within the clients.plex.tv/devices.xml endpoint. The flaw allows a non-server device token to retrieve tokens intended for other, unrelated devices. This effectively bypasses token isolation, enabling an attacker with a low-privilege token to enumerate and steal tokens for other devices, potentially gaining unauthorized access to media libraries, administrative functions, or other Plex services. The vulnerability is unpatched as of the advisory date, with a CVSS score of 5.0 (Medium), but the actual risk is elevated due to the ease of exploitation and the sensitive nature of the exposed tokens.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a server-side API flaw in Plex's proprietary backend. No supply chain compromise is involved.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – Only a non-server device token is needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the same as the affected component.
• Confidentiality (C): Low (L) – Token data is exposed, but not full system compromise.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium (5.0) – However, the ease of token theft and potential for lateral movement elevates the practical risk to High.

Deep Dive & Mechanics

The vulnerability resides in the clients.plex.tv/devices.xml API endpoint. Plex Media Server uses device tokens to authenticate and authorize client devices. Each device is supposed to have a unique token that grants access only to its own resources. However, the endpoint fails to properly validate that the requesting token belongs to the device being queried. Instead, it returns tokens for all devices associated with the Plex account when a valid (but non-server) token is provided.

Root Cause: Insufficient authorization checks on the server-side API. The endpoint likely iterates over all devices linked to the user account and returns their tokens without verifying that the requester is the server itself or has explicit permission to view other devices' tokens.

Attack Flow:

1. Attacker obtains a low-privilege device token (e.g., from a compromised client or by creating a dummy device).
2. Attacker sends a GET request to https://clients.plex.tv/devices.xml with the stolen token in the X-Plex-Token header.
3. The server responds with an XML document containing tokens for all devices associated with the account, including server tokens.
4. Attacker uses the stolen server token to gain full administrative access to the Plex Media Server.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the current implementation. A patched version would need to enforce token scoping, ensuring that a device token can only retrieve its own token or that the endpoint requires a server-level token.

Vulnerable (Conceptual):

@app.route('/devices.xml')
def get_devices():
    token = request.headers.get('X-Plex-Token')
    user = authenticate_token(token)
    if user:
        devices = get_all_devices_for_user(user.id)
        return render_xml(devices)  # Returns tokens for all devices
    return unauthorized()

Patched (Conceptual):

@app.route('/devices.xml')
def get_devices():
    token = request.headers.get('X-Plex-Token')
    device = authenticate_device_token(token)
    if device and device.is_server:
        devices = get_all_devices_for_user(device.user_id)
        return render_xml(devices)
    elif device:
        # Return only the requesting device's token
        return render_xml([device])
    return unauthorized()

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid non-server device token (e.g., from a mobile client or a created device).
• Network access to clients.plex.tv.

Exploit Steps:

1. Obtain a device token. For testing, create a dummy device via the Plex API or use a token from a compromised client.
2. Execute the following curl command:

   curl -H "X-Plex-Token: YOUR_DEVICE_TOKEN" https://clients.plex.tv/devices.xml
   

3. Parse the XML response to extract tokens for other devices, especially the server token.
4. Use the server token to access the Plex Media Server with full privileges:

   curl -H "X-Plex-Token: STOLEN_SERVER_TOKEN" http://<PMS_IP>:32400
   

Lab Setup:

• Deploy a Plex Media Server (any version through 2025-12-31) in a controlled environment.
• Register multiple devices (e.g., a mobile client and a server) under the same Plex account.
• Use a non-server token to exploit the endpoint.

Blue Team

Detection:

• Monitor for unusual requests to clients.plex.tv/devices.xml from non-server IPs.
• Alert on multiple token retrieval attempts within a short timeframe.
• Correlate with subsequent access to the Plex Media Server using different tokens.

Hunting:

• Search logs for X-Plex-Token header values that appear in multiple requests from different source IPs.
• Look for XML responses containing multiple <Device> entries with <Token> fields.

Indicators of Compromise (IOCs)

• Network: HTTP requests to clients.plex.tv/devices.xml with a non-server X-Plex-Token.
• Logs: Plex server logs showing authentication from multiple tokens originating from the same IP.
• File: XML files containing multiple device tokens (if exfiltrated).
• Behavior: A single IP address querying the /devices.xml endpoint repeatedly.

Detection Engineering

YARA Rule

rule Plex_Token_Theft_CVE_2025_69416 {
    meta:
        description = "Detects XML responses from clients.plex.tv/devices.xml containing multiple device tokens"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-69416"
    strings:
        $xml_header = "<MediaContainer"
        $device_tag = "<Device"
        $token_field = "<Token>"
    condition:
        $xml_header and #device_tag > 1 and #token_field > 1
}

Sigma Rule

title: Plex Token Enumeration via clients.plex.tv/devices.xml
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects attempts to enumerate device tokens from the Plex API endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: web
    product: proxy
detection:
    selection:
        cs-uri-query|contains: "/devices.xml"
        cs-host: "clients.plex.tv"
        cs-method: "GET"
    condition: selection
falsepositives:
    - Legitimate Plex client updates (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-69416 Plex Token Enumeration Attempt";
    flow:to_server;
    http.host; content:"clients.plex.tv";
    http.uri; content:"/devices.xml";
    http.method; content:"GET";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the endpoint: If possible, block access to clients.plex.tv/devices.xml at the network level (e.g., via firewall or proxy) until a patch is available.
2. Rotate all tokens: Invalidate and regenerate all device tokens for the affected Plex account.
3. Monitor logs: Review Plex server logs for any unauthorized access using stolen tokens.

Long-term Fix:

• Plex must implement proper authorization checks on the /devices.xml endpoint, ensuring that only server tokens can retrieve all device tokens, or that each token can only retrieve its own information.
• Apply the official patch once released.

Workarounds:

• Use a reverse proxy to add authentication headers or rate-limit requests to clients.plex.tv.
• Restrict Plex server access to trusted networks only.

Valters IT