Security issues in Plex/Web

Feature Suggestions
1

1. Sign in to Plex/Web 2.0.23 using Safari 7.0.3 on www.plex.tv

2. Open a Plex/Web link in a new tab or load the Apps page, which loads in a new tab

3. Sign out from the new tab

 

-> Bug: Old tab is not signed out. Expected behaviour is that it signs out of plex.tv completely if signed out once.

 

Also, Plex/Web 2.0.23 is not encrypted using SSL like the main page on www.plex.tv.

 

Security should not be an after-thought in development; it should be conceptualized and ingrained in development from the beginning.

2

It seems the Plex forums are vulnerable to the Heartbleed bug in OpenSSL:

Plex.tv has the OpenSSL bug too, but it can't be exploited:

Tested on http://possible.lv/tools/hb/

More information regarding Heartbleed: http://heartbleed.com

3

I think it would be wise to fix these security issues as soon as possible, as they're published and out in the open, ready to be exploited.

4

It appears the Plex forums have been patched against the Heartbleed bug. Kudos for the quick fix!

5

One more thing that's left to do to secure this forum is reissuing the SSL certificate, as the keys could have been stolen already:

Please do so as soon as possible, if you value the safety of your users' information.

Securing Plex/Web with SSL would also be appreciated.

6

I'd appreciate a re-key as well.  I spent hours resetting passwords last night, and want to check plex off the list.

7

It's kind of disappointing to report serious issues and get no response or acknowledgment from the developers whatsoever. I'm guessing Plex will only do something about their security when a data breach happens that is reported in the media, thus affecting its bottom line. For what it's worth, here are more exploitable security issues in Plex: http://seclists.org/fulldisclosure/2014/Apr/160

8

IFor what it's worth, everyone, here are some more exploitable security issues in Plex: http://seclists.org/fulldisclosure/2014/Apr/160

Just linking to the other post on the subject

9

It is very disappointing to report serious issues and get NO response or acknowledgment from the developers whatsoever. I'm guessing Plex Inc. will only do something about their security when a data breach happens that is reported in the media, thus affecting their bottom line. For what it's worth, everyone, here are some more exploitable security issues in Plex: http://seclists.org/fulldisclosure/2014/Apr/160


Agreed, worrying and disappointing to say the least.
10

Early 2021 clean-up: outdated / fixed