CVE-2020-5741

published 2020-05-08

CVE-2020-5741: Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code.

Priority P1 83 high 7.2 CVSS 3.1

AV N AC L PR H UI N S U C H I H A H

KEV ITW EXPLOIT

Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
plex	media_server	< 1.19.3	1.19.3

Detection & IOCs extracted from sources · hover to see the quote

path Dict↗

other X-Plex-Token↗

• → Detect abuse of the Plex Camera Upload feature to upload arbitrary files — the exploit requires an authenticated attacker to create a photo library and add arbitrary files to it via this feature. ↗
• → Monitor for Plex setting changes to the Windows-only variable 'LocalAppDataPath' being redirected to an attacker-controlled photo library directory, which triggers the malicious Dict unpickling. ↗
• → Alert on CISA KEV listing: CVE-2020-5741 is confirmed actively exploited in the wild; prioritize detection on any Plex Media Server instance on Windows. ↗
• → Hunt for keylogger installation following Plex RCE exploitation — in the confirmed LastPass incident, attackers used the RCE to install a keylogger and steal credentials. ↗

• · Exploitation requires authentication — the attacker must have access to the Plex server administrator's Plex account (Plex_Token). Unauthenticated exploitation is not possible. ↗
• · The exploit is Windows-only due to reliance on the Windows-specific Plex variable 'LocalAppDataPath'. ↗
• · If an exploit attempt fails or is cancelled, the malicious 'Dict' file is left on disk; subsequent exploit attempts require a new ALBUM_NAME as repeated writes produce 'Dict-1' instead of 'Dict', which will not execute. ↗
• · Code execution runs as the user who started the Plex Media Server process, so privilege level depends on the Plex service account configuration. ↗

CVSS provenance

nvd v3.1 7.2 HIGH CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

vulncheck 7.2 HIGH

cisa 7.2 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-502