Security News > 2023 > March > LastPass Hack: Engineer's Failure to Update Plex Software Led to Massive Data Breach

LastPass Hack: Engineer's Failure to Update Plex Software Led to Massive Data Breach
2023-03-07 06:21

The massive breach at LastPass was the result of one of its engineers failing to update Plex on their home computer, in what's a sobering reminder of the dangers of failing to keep software up-to-date.

The embattled password management service last week revealed how unidentified actors leveraged information stolen from an earlier incident that took place prior to August 12, 2022, along with details "Available from a third-party data breach and a vulnerability in a third-party media software package to launch a coordinated second attack" between August and October 2022.

The vulnerability in question is CVE-2020-5741, a deserialization flaw impacting Plex Media Server on Windows that allows a remote, authenticated attacker to execute arbitrary Python code in the context of the current operating system user.

"This issue allowed an attacker with access to the server administrator's Plex account to upload a malicious file via the Camera Upload feature and have the media server execute it," Plex said in an advisory released at the time.

The issue, which was discovered and reported to Plex by Tenable in March 2020, was addressed by Plex in version 1.19.3.2764 released on May 7, 2020.

"Unfortunately, the LastPass employee never upgraded their software to activate the patch," Plex said in a statement.


News URL

https://thehackernews.com/2023/03/lastpass-hack-engineers-failure-to.html

Related Vulnerability

DATE CVE VULNERABILITY TITLE RISK
2020-05-08 CVE-2020-5741 Deserialization of Untrusted Data vulnerability in Plex Media Server
Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code.
network
low complexity
plex CWE-502
7.2

Related vendor

VENDOR LAST 12M #/PRODUCTS LOW MEDIUM HIGH CRITICAL TOTAL VULNS
Plex 1 0 1 6 1 8