CVE-2020-5741
Plex Media Server Remote Code Execution Vulnerability
Description
CVE-2020-5741 is a deserialization of untrusted data vulnerability affecting Plex Media Server on Windows. This security flaw allows a remote, authenticated attacker to execute arbitrary Python code on the server by exploiting insecure deserialization in the Plex Media Server application. With a CVSS v3.1 score of 7.2 (High severity) and an EPSS score of 53.0% (97.9th percentile), CVE-2020-5741 represents a significant risk for organizations running Plex Media Server on Windows systems. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 31, 2023, confirming active exploitation in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| plex | media server | < 1.19.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/158470/Plex-Unpickle-Dict-Windows-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://www.tenable.com/security/research/tra-2020-32(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-5741(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
CWE-502 describes a weakness where an application deserializes untrusted data without sufficient verification, allowing an attacker to manipulate serialized objects to achieve unintended effects such as arbitrary code execution. In the case of CVE-2020-5741, Plex Media Server on Windows processes serialized Python objects from untrusted sources, enabling an authenticated attacker to inject malicious payloads that execute arbitrary Python code on the server.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2020-5741 carries a CVSS v3.1 score of 7.2 (High severity), reflecting the significant damage an attacker can inflict once they have authenticated access. Attack Vector (Network): The vulnerability is exploitable remotely over the network, meaning any authenticated user with network access to the Plex Media Server can attempt exploitation. Attack Complexity (Low): No special conditions or timing are required to exploit this flaw. Privileges Required (High): The attacker must have high-level (administrator) privileges on the Plex Media Server, which limits the attack surface to authenticated administrator accounts. User Interaction (None): No action from another user is needed to trigger the exploit. Confidentiality Impact (High): A successful exploit grants the attacker the ability to read arbitrary data on the server. Integrity Impact (High): The attacker can modify or delete files and data on the compromised system. Availability Impact (High): The attacker can disrupt the server's operation entirely. The EPSS score of 53.0% (97.9th percentile) indicates a high probability of exploitation, and public exploit code is available, making this vulnerability a priority for remediation.
Exploit Maturity
Public exploit code is available for CVE-2020-5741. A Metasploit-compatible exploit titled "Plex Unpickle Dict Windows Remote Code Execution" is published on Packet Storm Security, demonstrating how an authenticated attacker can leverage insecure Python deserialization (unpickling) to execute arbitrary code on the Plex Media Server. Additionally, Tenable has published a detailed security research advisory (TRA-2020-32) with technical exploitation details. CISA has confirmed active exploitation in the wild by adding CVE-2020-5741 to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 31, 2023. The EPSS score of 53.0% (97.9th percentile) further confirms that this Plex Media Server vulnerability is being actively targeted.
Remediation
- Update Plex Media Server to the latest available version immediately. The KEV required action states: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Plex has released patches that address the insecure deserialization vulnerability in affected Windows builds.
- Restrict network access to the Plex Media Server administration interface. Limit access to trusted IP addresses and networks using firewall rules or network segmentation to reduce the attack surface for authenticated exploitation.
- Enforce strong authentication and change default credentials. Ensure all Plex Media Server administrator accounts use strong, unique passwords and enable two-factor authentication where available to prevent unauthorized access.
- Monitor for suspicious activity on the Plex Media Server. Review server logs for unusual Python code execution, unexpected deserialization operations, or unauthorized administrative actions that could indicate exploitation attempts.
- Consider disabling remote access if not required. If the Plex Media Server does not need to be accessible from the internet, disable remote access features to eliminate the network-based attack vector entirely.
Technical Details
CVE-2020-5741 targets the deserialization mechanism in Plex Media Server on Windows, specifically exploiting Python's pickle deserialization functionality. Attack Vector (Network): The vulnerability is reachable over the network through the Plex Media Server's web interface or API endpoints that accept serialized data. Privileges Required (High): The attacker must first authenticate as an administrator, which can be achieved through compromised credentials or, in some configurations, through default or weak passwords. Once authenticated, the attacker can submit a crafted serialized Python object (pickle payload) to the server. When Plex Media Server deserializes this untrusted data without proper validation, the embedded malicious code is executed with the privileges of the Plex Media Server process, which typically runs as SYSTEM on Windows. This grants the attacker full control over the underlying operating system, enabling data exfiltration, lateral movement, or deployment of additional malware. The public exploit demonstrates this attack using a crafted Python dictionary object that triggers code execution during the unpickling process.
Frequently Asked Questions
Is CVE-2020-5741 being actively exploited?
Yes, CVE-2020-5741 has been actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 31, 2023. Public exploit code is available on Packet Storm Security, and Tenable has published a detailed security research advisory documenting the exploitation technique.
What products are affected by CVE-2020-5741?
CVE-2020-5741 affects Plex Media Server running on Windows. The vulnerability is in the deserialization functionality of the application. Users running Plex Media Server on other operating systems may not be affected by this specific attack vector, but should still ensure their installations are up to date.
How do I fix CVE-2020-5741?
Update Plex Media Server to the latest available version that includes the security fix. Additionally, restrict network access to the administration interface, enforce strong authentication, and monitor server logs for suspicious activity. If the server is not needed publicly, disable remote access to reduce the attack surface.
How severe is CVE-2020-5741?
CVE-2020-5741 is rated High severity with a CVSS v3.1 score of 7.2. While it requires high privileges (administrator access) for exploitation, a successful attack results in full compromise of confidentiality, integrity, and availability. The EPSS score of 53.0% (97.9th percentile) indicates a high probability of exploitation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.