CVE-2020-5741

What is Plex Media Server?

Plex Media Server is a self-hosted media streaming platform that organizes and serves a user's personal video, music, and photo library, widely run on home NAS devices and personal servers. Its Camera Upload feature is designed to automatically import photos and videos from a connected device into the user's media library for organization and playback.

Overview

CVE-2020-5741 is a deserialization vulnerability (CWE-502) in Plex Media Server that allows remote code execution. An attacker who has obtained access to the server administrator's Plex account can abuse the Camera Upload feature to deliver a malicious file to the server, which the media server then processes in a way that leads to code execution (CVSS 3.1: AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2 High) — a post-authentication bug requiring the attacker to already control the account, rather than an unauthenticated network-facing vulnerability.

Technical Details

The Camera Upload feature accepts uploaded media files and processes them as part of adding them to the user's library. Insufficient validation of the uploaded content allows a maliciously crafted file to trigger unsafe deserialization during that processing step, resulting in arbitrary code execution in the context of the Plex Media Server process rather than the file being handled purely as inert media content.

Discovery

Reported to Plex through its security disclosure process; Plex published details and a fix via its community forums.

Exploitation Context

CISA added this CVE to KEV in March 2023, nearly three years after original disclosure, based on confirmed exploitation. Because exploitation requires prior access to the administrator's Plex account, real-world attacks likely depend on credential compromise (weak passwords, credential reuse, or phishing) as the initial step, with this vulnerability serving as the escalation from account access to server-level code execution.

Remediation

1. Update Plex Media Server to the fixed version specified in Plex's security advisory immediately.
2. Use a strong, unique password and enable two-factor authentication on your Plex account, since this vulnerability's exploitability depends on an attacker first gaining account access.
3. Restrict Camera Upload to trusted devices only, and review connected devices in your Plex account settings for any you don't recognize.
4. Audit your Plex Media Server host for unexpected processes or files if you suspect your Plex account credentials may have been compromised at any point.