Plex Media Server Unsigned Codec dlopen Code Execution via TranscoderH264Options File Write

#!/usr/bin/env bash
# check_plex_cve2026_96656.sh — Detect CVE-2026-96656 (Plex2Shell chain)
# Run on target Plex Media Server host as root or plex user.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

FIXED_VERSION="1.43.3.10861"
RESULT="UNKNOWN"

# Locate Plex Media Server binary
PLEX_BIN=""
for candidate in \
  /usr/lib/plexmediaserver/Plex\ Media\ Server \
  /usr/lib/plexmediaserver/"Plex Media Server" \
  /Applications/Plex\ Media\ Server.app/Contents/MacOS/Plex\ Media\ Server \
  /volume1/@appstore/PlexMediaServer/Plex\ Media\ Server; do
  if [[ -x "$candidate" ]] 2>/dev/null; then
    PLEX_BIN="$candidate"
    break
  fi
done

# Try Docker if no local binary
if [[ -z "$PLEX_BIN" ]]; then
  DOCKER_VER=$(docker exec plex /usr/lib/plexmediaserver/"Plex Media Server" --version 2>/dev/null || true)
  if [[ -n "$DOCKER_VER" ]]; then
    INSTALLED_VERSION=$(echo "$DOCKER_VER" | grep -oP '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | head -1)
  fi
fi

# Get version from binary
if [[ -n "${PLEX_BIN:-}" ]]; then
  RAW_VER=$("$PLEX_BIN" --version 2>/dev/null || true)
  INSTALLED_VERSION=$(echo "$RAW_VER" | grep -oP '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | head -1)
fi

if [[ -z "${INSTALLED_VERSION:-}" ]]; then
  echo "[UNKNOWN] Could not determine Plex Media Server version."
  echo "Ensure Plex is installed and the script is run with appropriate permissions."
  exit 2
fi

echo "Installed Plex version: $INSTALLED_VERSION"
echo "Fixed version:          $FIXED_VERSION"

# Compare versions (dot-separated numeric)
version_gte() {
  local IFS=.
  local i a=($1) b=($2)
  for ((i=0; i<${#b[@]}; i++)); do
    if (( ${a[i]:-0} > ${b[i]:-0} )); then return 0; fi
    if (( ${a[i]:-0} < ${b[i]:-0} )); then return 1; fi
  done
  return 0
}

if version_gte "$INSTALLED_VERSION" "$FIXED_VERSION"; then
  RESULT="PATCHED"
else
  RESULT="VULNERABLE"
fi

# Check Codecs directory for suspicious .so files (indicator of compromise)
CODEC_DIRS=(
  "/var/lib/plexmediaserver/Library/Application Support/Plex Media Server/Codecs"
  "$HOME/Library/Application Support/Plex Media Server/Codecs"
  "/config/Library/Application Support/Plex Media Server/Codecs"
)

SUSPICIOUS_FILES=0
for cdir in "${CODEC_DIRS[@]}"; do
  if [[ -d "$cdir" ]]; then
    while IFS= read -r -d '' sofile; do
      # Check for suspicious strings in .so files
      if strings "$sofile" 2>/dev/null | grep -qiE '(wget|curl|/bin/sh|xmrig|mining|proxy|sslip\.io)'; then
        echo "[IOC] Suspicious .so file: $sofile"
        SUSPICIOUS_FILES=$((SUSPICIOUS_FILES + 1))
      fi
    done < <(find "$cdir" -name '*.so' -print0 2>/dev/null)
  fi
done

if [[ $SUSPICIOUS_FILES -gt 0 ]]; then
  echo "[ALERT] Found $SUSPICIOUS_FILES suspicious .so file(s) in Codecs directory — possible active compromise!"
fi

echo ""
echo "[$RESULT] CVE-2026-96656 (Plex2Shell chain)"

if [[ "$RESULT" == "VULNERABLE" ]]; then
  exit 1
elif [[ "$RESULT" == "PATCHED" ]]; then
  exit 0
else
  exit 2
fi