QNAP, a maker of network-attached storage (NAS) devices, says some customers' Plex Media Server installations on its devices appear to have been compromised through a chain of flaws known as "Plex2Shell," BleepingComputer reported Friday. The warning matters to small businesses and home offices that keep files on these boxes, because QNAP says patching the app does not remove what attackers already installed.
What Happened
A NAS is a storage device that sits on a network so several people can share files. Many owners also run Plex Media Server on it, an app that streams a video and music library to other devices. In a security notice, QNAP said it had received reports from some users whose Plex servers appeared to be compromised and that its technical support team is helping them.
Plex2Shell is four flaws in Plex Media Server 1.43.2 and earlier. Each carries limited risk alone, but chained together they let an attacker with no account run code on the device with the Plex app's privileges, according to QNAP, which relayed Plex's description. Plex has confirmed the flaws are being actively and widely exploited, and compromised servers have been used to run cryptocurrency-mining and proxy software, QNAP said.
Researcher Zach Main reported the flaws to Plex on July 27, and attacks began soon after full technical details were published Oct. 16, BleepingComputer reported. The Cybersecurity and Infrastructure Security Agency (CISA) added all four to its Known Exploited Vulnerabilities catalog on Oct. 20, setting federal deadlines of Oct. 23 for two of them and Nov. 3 for the others.
QNAP's product security team said its own operating systems, QTS and QuTS hero, are not vulnerable.
Why It Matters
The case shows that a fully patched storage device can still be taken over through third-party software running on it. A hijacked NAS puts the business files stored on it within an attacker's reach.
What Owners Should Do
QNAP tells owners to update Plex Media Server to version 1.43.3.10861 or later through its App Center. If Plex was reachable from the internet while running an older version, through Plex's remote access feature or a router port opened manually or automatically, QNAP says to treat the NAS as potentially compromised: reinstall it cleanly, check it against the signs of compromise QNAP lists, and reset Plex and NAS passwords. It also advises turning off remote access when not needed and using a VPN, or virtual private network, instead.
What to Watch
Whether QNAP or Plex discloses how many devices were hit, and whether other NAS makers that offer Plex issue similar warnings. QNAP says it will examine logs from customers who suspect a compromise.
