Failure to implement three-year-old Plex update led to LastPass security breach

One of the two significant security breaches that affected LastPass last year could have been avoided with a three-year-old Plex update. This was revealed when more details about the second incident were revealed.

As a result of an exploit in Plex, a cloud storage service for movie storage and streaming, a malicious party was able to install a keylogger on a senior engineer’s home computer and access corporate-level caches. However, it appears that the engineer was also involved in this tragic accident.

Plex has disclosed that the previously stated attack exploited a flaw that was first publicly disclosed on May 7, 2020. And the LastPass employee whose computer was compromised never upgraded their client to deploy the fix.

By interlacing the locations of the server data directory and a library that allowed Camera Uploads, people with access to a server administrator’s Plex account could upload a malicious program through the Camera Upload functionality and have the media server run it.

The flaw allowed those with access to a server administrator’s Plex account to upload a malicious file via the Camera Upload feature and have the media server execute it by overlapping the locations of the server data directory with a library that allowed Camera Uploads. To close the gap, the company released Plex Media Server v1.19.3 the same day.

The sources for this piece include an article in AndroidPolice.

IT World Canada Staff
IT World Canada Staff
The online resource for Canadian Information Technology professionals.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

ITW in your inbox

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

More Best of The Web