plex arbitrary file read

[h00die]

Description

This PR introduces a Plex arbitrary file read against Plex Media Server (<= 1.43.2.10687, and the first 1.43.3 build 10828). Plex announced on 9/1 via https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319 to update servers. They haven't said why you need to update your server though, but it seems to be because of an arbitrary file read potentially unauthenticated (if on local network). Bad things. I'm sure there's a CVE, but it hasn't been released to the public yet from what I can tell.

Breaking Changes

None

Reviewer Notes

Docker setup included, runs 2 vuln versions of plex (diff branches of the code) so you can test both.

Verification Steps

1. • Run docker compose
2. • Start msfconsole
3. • Do: use auxiliary/scanner/http/plex_media_server_file_read
4. • Do: set rport 32402
5. • Do: set rhosts 127.0.0.1
6. • Do: set file /etc/passwd
7. • Do: run
8. • You should get the contents of the file

AI Usage Disclosure

GLM-5.3 assisted in finding the vuln and writing the initial code. I did testing and cleanup.