Plex QNAP root access

Plex Media Server NAS & Devices
1

Server Version#: 1.20.4.3517

I found a huge security flaw in QNAP Plex server. I start searching for fix and found this topic: https://forum.qnap.com/viewtopic.php?t=140047. First post in Mar 2018, and no fixes since then? I truly believe you should take away Plex server from downloads until this will be fixed on QNAP side. As you can read, Synology already fixed, QNAP not. If you want to provide Plex to QNAP users you must provide instructions how to create VM and run Plex inside VM.

2

As others pointed out in the thread in the QNAP forum
 that’s not specific to Plex but how QNAP runs their apps. I won’t advocate or justify their design decision/approach — but
 why should Plex punish their users for QNAP‘s failure to respond? Have you considered opening a case with QNAP (not just posting in their forum)?

3

Plex punish their users by creating a huge security flaw in their NASes. If Plex can’t make run the app securely (despite of where is the root of the problem—at Plex or at QNAP), they should not allow run the app at all. It’s obvious and a common sense. As you can read in that thread, there were already opened case with QNAP and they ignored it. So, only the public discussion can solve the situation.

4

@m_emelchenkov1

You are complaining to the wrong people.

The QNAP QDK (QNAP’s SDK) runs apps as root.
QTS provides the security to shared folders through its API.

If you have a problem with it, please take it up with them or don’t use QNAP products.

If your NAS isn’t physically secure or you don’t trust the people in your home, you have bigger issues to resolve.

5

I am glad you are aware of this issue and agreed it exists. But your rhetoric is counter-productive, you don’t want to admit the obvious. Should I consider this “won’t fix” as the official position of your company?

6

You can infer no such statement or position by Plex.

I will not engage in this non-productive discussion further as, by your own statement,

  1. As the QNAP NAS administrator:
    a. You are empowered to look at anything on the system.
    b. You are also the only user who can install PMS (App Center requirement)

  2. You are not seeing a security hole. You are viewing other users’ files using the authority granted you by QTS - which is BY DESIGN because you signed in with the credentials granting you that access level.

  3. When PMS is configured, users have NO access to the host OS / file system its installed on. They may only play or sync the media to which they have been granted access by the PMS account holder.

Have a nice day.

7

This is not on Plex.

This statement is unfair, untrue and very aggressive.

If you feel this strongly about it, stop using Plex on QNAP. In fact, stop using QNAP.

Regardless, it is wrong to blame Plex for something that QNAP allows. It is also not fair to expect Plex to spin-off and maintain a special version to handle this given that Plex is for individuals, friends and families (not corporations).

1 Like
8

Closing this thread, since it’s a road to nowhere, and @ChuckPa already said that this is not related to Plex

3 Likes