# Plex Remote Code Execution Exploit used in Lastpass Breach?

**URL:** <https://forums.plex.tv/t/plex-remote-code-execution-exploit-used-in-lastpass-breach/832727>\
**Category:** General Discussions\
**Created:** [February 28, 2023, 2:38am UTC](https://forums.plex.tv/t/plex-remote-code-execution-exploit-used-in-lastpass-breach/832727 "2023-02-28T02:38:55Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![perplexity](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/perplexity/32/270929_2.png) [@perplexity](https://forums.plex.tv/u/perplexity)\
**Post date:** [February 28, 2023, 2:38am UTC](https://forums.plex.tv/t/plex-remote-code-execution-exploit-used-in-lastpass-breach/832727/1 "2023-02-28T02:38:55Z")

</div>

[https://arstechnica.com/information-technology/2023/02/lastpass-hackers-infected-employees-home-computer-and-stole-corporate-vault/](https://arstechnica.com/information-technology/2023/02/lastpass-hackers-infected-employees-home-computer-and-stole-corporate-vault/)

From the article "“_This was accomplished by targeting the DevOps engineer’s home computer and exploiting a vulnerable third-party media software package, which enabled remote code execution capability and allowed the threat actor to implant keylogger malware,”_

_“According to a person briefed on a private report from LastPass and spoke on the condition of anonymity, the media software package that was exploited on the employee’s home computer was Plex.”_

While I’m aware probably nothing will be acknowledged or admitted here or elsewhere regarding the accuracy of the report, or if the alleged exploit has since been identified and patched, I felt like this was worth sharing so end users can at least be aware. Perhaps there are others who hold keys to kingdoms that may want to uninstall Plex from those systems as a result.

---

<div class="post-metadata">

**Author:** ![JohnAlex](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/johnalex/32/5694_2.png) [@JohnAlex](https://forums.plex.tv/u/JohnAlex)\
**Post date:** [February 28, 2023, 4:28am UTC](https://forums.plex.tv/t/plex-remote-code-execution-exploit-used-in-lastpass-breach/832727/2 "2023-02-28T04:28:19Z")

</div>

As I have said in the threads over the years in the couple of other ‘security’ issues with Plex in my 10 years with them, I don’t expect total impunity to hackers but I do expect total transparency from Plex and with urgency.

Please note it was **supposedly** someone that had seen the report from **LastPass** that said it may have been a security hole in Plex that allowed a keylogger to be run. Anyone that believes anything that LastPass says is a fool.

As one person said in the comments …

_unless he was running a (Plex) version from prior to mid-2020, it didn’t have a remote code execution flaw that we know about, and at no point did the article say that it did or even imply that._

---

<div class="post-metadata">

**Author:** ![BenGradish](https://avatars.discourse-cdn.com/v4/letter/b/dec6dc/32.png) [@BenGradish](https://forums.plex.tv/u/BenGradish)\
**Post date:** [February 28, 2023, 12:51pm UTC](https://forums.plex.tv/t/plex-remote-code-execution-exploit-used-in-lastpass-breach/832727/3 "2023-02-28T12:51:59Z")

</div>

Would like to see an official statement from Plex as well.

---

<div class="post-metadata">

**Author:** ![JoeC3](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/joec3/32/91353_2.png) [@JoeC3](https://forums.plex.tv/u/JoeC3)\
**Post date:** [February 28, 2023, 5:19pm UTC](https://forums.plex.tv/t/plex-remote-code-execution-exploit-used-in-lastpass-breach/832727/4 "2023-02-28T17:19:58Z")

</div>

It’s probably not a bad idea to turn off remote access until we know what the issue was and whether it was fixed.

---

<div class="post-metadata">

**Author:** ![JohnAlex](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/johnalex/32/5694_2.png) [@JohnAlex](https://forums.plex.tv/u/JohnAlex)\
**Post date:** [February 28, 2023, 7:42pm UTC](https://forums.plex.tv/t/plex-remote-code-execution-exploit-used-in-lastpass-breach/832727/5 "2023-02-28T19:42:49Z")

</div>

> [@JoeC3](#):
>
> turn off remote access

Plex by design ‘communicates’ externally even if remote access is turned off.

I’ve yet to see confirmation of the issue from LastPass let alone Plex nor what the issue actually is…

---

<div class="post-metadata">

**Author:** ![blactuary](https://avatars.discourse-cdn.com/v4/letter/b/5e9695/32.png) [@blactuary](https://forums.plex.tv/u/blactuary)\
**Post date:** [February 28, 2023, 8:24pm UTC](https://forums.plex.tv/t/plex-remote-code-execution-exploit-used-in-lastpass-breach/832727/6 "2023-02-28T20:24:57Z")

</div>

Yeah, it would be nice to have some communication from Plex here, even if it’s just “we are looking into it and will have an update as soon as possible”. Just some kind of acknowledgment and letting us know if we should be restricting any access. Who knows maybe he had a really out of date version or poor security on user accounts, but not hearing anything is troubling.

---

<div class="post-metadata">

**Author:** ![adefaria](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/adefaria/32/300475_2.png) [@adefaria](https://forums.plex.tv/u/adefaria)\
**Post date:** [February 28, 2023, 9:06pm UTC](https://forums.plex.tv/t/plex-remote-code-execution-exploit-used-in-lastpass-breach/832727/7 "2023-02-28T21:06:30Z")

</div>

Are we sure it isn’t simply a case of password reuse, where the password to the AWS bucket was the same as his Plex password?

---

<div class="post-metadata">

**Author:** ![sixxnet](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@sixxnet](https://forums.plex.tv/u/sixxnet)\
**Post date:** [February 28, 2023, 9:15pm UTC](https://forums.plex.tv/t/plex-remote-code-execution-exploit-used-in-lastpass-breach/832727/8 "2023-02-28T21:15:24Z")

</div>

By evaluating Plex and the extreme difficulty they have making basic functions reliable or breaking something by fixing another then there is a high probability this software is nowhere near secure.

Prove otherwise.

Better lock down your remote Plex ports to authorized subnets only.

---

<div class="post-metadata">

**Author:** ![JohnAlex](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/johnalex/32/5694_2.png) [@JohnAlex](https://forums.plex.tv/u/JohnAlex)\
**Post date:** [February 28, 2023, 9:39pm UTC](https://forums.plex.tv/t/plex-remote-code-execution-exploit-used-in-lastpass-breach/832727/9 "2023-02-28T21:39:50Z")

</div>

> [@adefaria](#):
>
> Are we sure it isn’t simply a case of password reuse

Well all we have for now is an unidentified source saying they saw a report from LastPass suggesting it was a flaw in Plex.

I frankly don’t believe anything from LastPass given their history.

Plex have yet to make comment, which in itself, is concerning.

Could be nothing but given the couple of Plex hacks that have occurred in the past, it would be nice to have an official response in a timely manner.

---

<div class="post-metadata">

**Author:** ![adefaria](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/adefaria/32/300475_2.png) [@adefaria](https://forums.plex.tv/u/adefaria)\
**Post date:** [February 28, 2023, 9:53pm UTC](https://forums.plex.tv/t/plex-remote-code-execution-exploit-used-in-lastpass-breach/832727/10 "2023-02-28T21:53:16Z")

</div>

While I understand that LastPass has not been forthcoming, I would not translate that to “I wouldn’t believe **anything** from LastPass”. Surely what they say should be suspect until proven. Anyways, I switched to a self-hosted instance of VaultWarden/BitWarden long ago.

---

<div class="post-metadata">

**Author:** ![PlexInfo](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/plexinfo/32/85165_2.png) [@PlexInfo](https://forums.plex.tv/u/PlexInfo)\
**Post date:** [February 28, 2023, 9:55pm UTC](https://forums.plex.tv/t/plex-remote-code-execution-exploit-used-in-lastpass-breach/832727/11 "2023-02-28T21:55:53Z")

</div>

We have not been contacted by LastPass so we cannot speak to the specifics of their incident. We take security issues very seriously, and frequently work with external parties who report issues big or small using our [guidelines and bug bounty program](https://support.plex.tv/articles/reporting-security-issues/). When vulnerabilities are reported following responsible disclosure we address them swiftly and thoroughly, and we’ve never had a critical vulnerability published for which there wasn’t already a patched version released. And when we’ve had incidents of our own, we’ve always chosen to communicate them quickly. We are not aware of any unpatched vulnerabilities, and as always, we invite people to disclose issues to us following the guidelines linked above. Given recent articles about the LastPass incident, although we are not aware of any unpatched vulnerabilities, we have reached out to LastPass to be sure.

---

<div class="post-metadata">

**Author:** ![JohnAlex](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/johnalex/32/5694_2.png) [@JohnAlex](https://forums.plex.tv/u/JohnAlex)\
**Post date:** [February 28, 2023, 10:00pm UTC](https://forums.plex.tv/t/plex-remote-code-execution-exploit-used-in-lastpass-breach/832727/12 "2023-02-28T22:00:34Z")

</div>

> [@adefaria](#):
>
> I would not translate that to “I wouldn’t believe **anything** from LastPass”.

They have been shown to actually lie about security previously.

So, yes, I would not believe them, especially not an unidentified source who spoke with anonymity.

Now, I do have more faith in Plex and it is good to see a company response.

I am looking forward to what develops. For now, I have implemented extra measures, specifically for Plex.

Edit - note that I have not and currently do not use LastPass. That is not the issue. The issue is possible vulnerabilities in Plex.

---

<div class="post-metadata">

**Author:** ![adefaria](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/adefaria/32/300475_2.png) [@adefaria](https://forums.plex.tv/u/adefaria)\
**Post date:** [February 28, 2023, 10:15pm UTC](https://forums.plex.tv/t/plex-remote-code-execution-exploit-used-in-lastpass-breach/832727/13 "2023-02-28T22:15:57Z")

</div>

I understand they weren’t exactly truthful in the past. That does not translate to 100% of everything that comes out of their mouth being 100% a lie. Would I be suspicious of what they say? Certainly. But to lie 100% of the time would mean to pull a Geroge Stantos and I’d say even he tells the truth on occasion. I guess that’s the difference between you and me. It’s a question of absolutes and I try to steer clear of them because they are **always** wrong - 100% of the time! 🤣

---

<div class="post-metadata">

**Author:** ![JohnAlex](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/johnalex/32/5694_2.png) [@JohnAlex](https://forums.plex.tv/u/JohnAlex)\
**Post date:** [February 28, 2023, 10:37pm UTC](https://forums.plex.tv/t/plex-remote-code-execution-exploit-used-in-lastpass-breach/832727/14 "2023-02-28T22:37:46Z")

</div>

> [@adefaria](#):
>
> It’s a question of absolutes

No it really isn’t.

If someone lies to me, I no longer trust them nor do I believe anything they tell me without 3rd party confirmation - specifically on this topic.

At the moment we have an anoynmous source saying it was a vulnerability in Plex based on a report they saw from LastPass.

Wow.

---

<div class="post-metadata">

**Author:** ![muoto](https://avatars.discourse-cdn.com/v4/letter/m/e56c9b/32.png) [@muoto](https://forums.plex.tv/u/muoto)\
**Post date:** [February 28, 2023, 10:48pm UTC](https://forums.plex.tv/t/plex-remote-code-execution-exploit-used-in-lastpass-breach/832727/15 "2023-02-28T22:48:23Z")

</div>

I sympathize with Plex here; unless LastPass or the employee in question chooses to cooperate, they don’t really have any details to go on–and so also no way to assuage our concerns.

EDIT: That said, for the time being, I’ve disabled remote access.

---

<div class="post-metadata">

**Author:** ![adefaria](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/adefaria/32/300475_2.png) [@adefaria](https://forums.plex.tv/u/adefaria)\
**Post date:** [February 28, 2023, 10:57pm UTC](https://forums.plex.tv/t/plex-remote-code-execution-exploit-used-in-lastpass-breach/832727/16 "2023-02-28T22:57:01Z")

</div>

Yes, it really is…

To be pedantic here for a second - that’s exactly what absolutes are. When you say “anything” you are stating it in absolute terms, IOW without exception. As an example, if LP was to say “The sky today was blue and Plex had nothing to do with our breach” you’d have to question the sky is blue part equally as the second part in order for the term **anything** to make any sense. That’s how English and absolutes work.

We now return you to our conversation about Plex and LP… already in progress.

---

<div class="post-metadata">

**Author:** ![Kilgry](https://avatars.discourse-cdn.com/v4/letter/k/73ab20/32.png) [@Kilgry](https://forums.plex.tv/u/Kilgry)\
**Post date:** [February 28, 2023, 10:59pm UTC](https://forums.plex.tv/t/plex-remote-code-execution-exploit-used-in-lastpass-breach/832727/17 "2023-02-28T22:59:37Z")

</div>

Oh goodie. This is fun.

---

<div class="post-metadata">

**Author:** ![JohnAlex](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/johnalex/32/5694_2.png) [@JohnAlex](https://forums.plex.tv/u/JohnAlex)\
**Post date:** [February 28, 2023, 11:01pm UTC](https://forums.plex.tv/t/plex-remote-code-execution-exploit-used-in-lastpass-breach/832727/18 "2023-02-28T23:01:03Z")

</div>

> [@adefaria](#):
>
> “The sky today was blue and Plex had nothing to do with our breach”

WTF.

You are confusing yourself.

The discussion is purposely on LP and Plex.

---

<div class="post-metadata">

**Author:** ![JohnAlex](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/johnalex/32/5694_2.png) [@JohnAlex](https://forums.plex.tv/u/JohnAlex)\
**Post date:** [February 28, 2023, 11:05pm UTC](https://forums.plex.tv/t/plex-remote-code-execution-exploit-used-in-lastpass-breach/832727/19 "2023-02-28T23:05:11Z")

</div>

> [@Kilgry](#):
>
> This is fun.

The ‘news items’ on the topic are like listening to Fox News 😃

---

<div class="post-metadata">

**Author:** ![captnkoch](https://avatars.discourse-cdn.com/v4/letter/c/779978/32.png) [@captnkoch](https://forums.plex.tv/u/captnkoch)\
**Post date:** [February 28, 2023, 11:08pm UTC](https://forums.plex.tv/t/plex-remote-code-execution-exploit-used-in-lastpass-breach/832727/20 "2023-02-28T23:08:10Z")

</div>

Thank you for responding to my tweet \<3.

Of course we understand there are not concrete details yet, but I’m sure you can understand why even a threat of an RCE in the Plex software could be very nervous. Transparency is key here.

To be more clear, nobody should be pointing fingers, we just need everyone to be aware of what’s being reported just in case. We could totally end up finding out it was a “Plex server” that was pwned by a Windows or Linux vuln or that the whole thing was BS, or one of 19 million other things. Point being - If my company was being “associated” with some kind of 0day obviously I’d want to be on high alert, looking for IOC’s, reviewing logs, and making sure my customers know we’re aware of the “reports” and looking into it.

Hopefully that makes sense.

[Next page](https://forums.plex.tv/t/plex-remote-code-execution-exploit-used-in-lastpass-breach/832727.md?page=2)