FreshPorts - VuXML

Chris reports:

The XML parsing engine for Plex Media Server's SSDP/UPNP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Unauthenticated attackers on the same LAN can use this vulnerability to:

• Access arbitrary files from the filesystem with the same permission as the user account running Plex.
• Initiate SMB connections to capture NetNTLM challenge/response and crack to clear-text password.
• Initiate SMB connections to relay NetNTLM challenge/response and achieve Remote Command Execution in Windows domains.

< 1.13.5.5332

Plex Security Team reports:

We have recently been made aware of a security vulnerability in Plex Media Server versions prior to 1.25.0 that could allow a local Windows user to obtain administrator privileges without authorization. To be clear, this required the user to already have local, physical access to the computer (just with a different user account on Windows). There are no indications that this exploit could be used from a remote machine.

Plex Media Server versions 1.25.0.5282 and newer are not subject to this vulnerability, and feature additional hardening to prevent similar issues from occurring in the future. Users running older server versions are encouraged to update their Plex Media Server installations.

< 1.25.0