LastPass Hack: Engineer's Failure to Update Plex Software Led to Massive Data Breach
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-5741 | Authenticated Deserialization RCE in Plex Media Server on Windows CVE-2020-5741 is a deserialization-of-untrusted-data flaw (CWE-502) in Plex Media Server on Windows: the server deserializes a serialized Python (pickle) object supplied over the network without adequate validation. A remote attacker who has already authenticated with high-privilege credentials to the server can submit a maliciously crafted serialized object, causing the server to execute arbitrary Python code upon deserialization. Successful exploitation yields code execution in the context of the Plex Media Server process on the Windows host, exposing that machine's data and credentials and, as demonstrated in the 2022 LastPass breach, potentially providing a foothold into connected environments. Windows installations running a release without the vendor's 2020 security fix are affected; Linux/NAS deployments are outside the described scope of this flaw. Exploitation is confirmed: it carries a 72.9% EPSS probability (99th percentile), has public PoC exploits (Tenable TRA-2020-32 and a PacketStorm write-up), was added to CISA's KEV catalog on 2023-03-10, and is publicly linked to the LastPass breach, where an unpatched Plex Media Server on an employee's PC was the entry point. Do: Update Plex Media Server on every Windows host to the latest release per vendor instructions (a fix shipped in 2020), prioritizing machines used by staff with privileged or remote access, and verify versions by inventory since unpatched instances remain common. Because exploitation requires authenticated high-privilege Plex credentials, review and rotate those credentials and check affected hosts for indicators of compromise such as unexpected processes or lateral movement, as demonstrated in the LastPass incident. | 7.2 | 73% | KEV PoC ×2 |
| large≈300,000+ exposed/vulnerable Plex Media Server instances, with the Windows subset affected by this flaw |
Full article348 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMar 07, 2023Password Security / Software Update
The massive breach at LastPass was the result of one of its engineers failing to update Plex on their home computer, in what's a sobering reminder of the dangers of failing to keep software up-to-date.
The embattled password management service last week revealed how unidentified actors leveraged information stolen from an earlier incident that took place prior to August 12, 2022, along with details "available from a third-party data breach and a vulnerability in a third-party media software package to launch a coordinated second attack" between August and October 2022.
The intrusion ultimately enabled the adversary to steal partially encrypted password vault data and customer information.
The second attack specifically singled out one of the four DevOps engineers, targeting their home computer with a keylogger malware to obtain the credentials and breach the cloud storage environment.
This, in turn, is said to have been made possible by exploiting a nearly three-year-old now-patched flaw in Plex to achieve code execution on the engineer's computer, the streaming media service told The Hacker News in a statement.
The vulnerability in question is CVE-2020-5741 (CVSS score: 7.2), a deserialization flaw impacting Plex Media Server on Windows that allows a remote, authenticated attacker to execute arbitrary Python code in the context of the current operating system user.
"This issue allowed an attacker with access to the server administrator's Plex account to upload a malicious file via the Camera Upload feature and have the media server execute it," Plex said in an advisory released at the time.
The shortcoming, which was discovered and reported to Plex by Tenable in March 2020, was addressed by Plex in version 1.19.3.2764 released on May 7, 2020. The current version of Plex Media Server is 1.31.1.6733.
"Unfortunately, the LastPass employee never upgraded their software to activate the patch," Plex said in a statement. "For reference, the version that addressed this exploit was roughly 75 versions ago."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2023/03/lastpass-hack-engineers-failure-to.html