Unauthenticated RCE in NextGen Mirth Connect <= 4.3.0

Repository contains a standalone Python exploit for NextGen Mirth Connect targeting CVE-2023-43208 (and referencing CVE-2023-37679). The main file (CVE-2023-43208.py) builds an XML payload that leverages a Java gadget chain (Apache Commons Collections4 + Commons Lang3 EventUtils invocation handler) to invoke java.lang.Runtime.exec() on the server. It sends the payload via an unauthenticated HTTP POST to the Mirth Connect API endpoint /api/users with headers Content-Type: application/xml and X-Requested-With: OpenAPI, with TLS verification disabled. Capabilities: - Arbitrary command execution (one-shot) on the target host; optional Windows command wrapping using cmd.exe /c. - Reverse shell mode: if -lh/-lp are provided, it auto-generates a bash /dev/tcp reverse shell command to connect back to the attacker. - Includes a simple built-in TCP listener (binds 0.0.0.0:<port>) to accept a single incoming connection and print received data. Repository structure: - CVE-2023-43208.py: exploit implementation, CLI parsing, payload generation, HTTP delivery, optional listener. - README.md: high-level vulnerability description and affected versions (claims up to 4.4.0; fixed in 4.4.1). - use.txt: usage examples for command execution and reverse shell (notes using netcat externally; script also has its own listener).

Repository contains a single Python exploit (exploit.py) plus documentation (README.md) targeting CVE-2023-43208: a pre-auth remote code execution vulnerability in NextGen Healthcare Mirth Connect versions < 4.4.1. The exploit sends a crafted XStream XML payload to the unauthenticated POST /api/users endpoint. The payload is a deserialization gadget chain that bypasses the prior denylist-based fix for CVE-2023-37679 by using org.apache.commons.lang3.event.EventUtils$EventBindingInvocationHandler (dynamic proxy handler) together with Apache Commons Collections4 transformers (ChainedTransformer/ConstantTransformer/InvokerTransformer) to invoke java.lang.Runtime.getRuntime().exec(command). Key capabilities implemented via argparse subcommands: - check: fingerprints the target (uses /api/server/version) and assesses likely vulnerability. - exec: performs blind command execution (no command output expected). - shell: triggers a reverse shell back to attacker-supplied --lhost/--lport and includes listener handling (socket/select/threading indicated by imports and CLI options). - scan: multi-target scanning from a file with configurable thread count and optional output of vulnerable hosts. Notable operational details: uses Python requests with TLS warnings disabled (suggesting self-signed certs common on :8443), sets headers including Content-Type: application/xml and X-Requested-With: OpenAPI, and builds/escapes XML to embed arbitrary commands safely into the serialized gadget chain.

This repository contains a single Metasploit module targeting Mirth Connect (NextGen) for two deserialization vulnerabilities: CVE-2023-37679 and CVE-2023-43208. The exploit leverages crafted XML payloads sent via POST requests to the /api/users endpoint, exploiting insecure deserialization to achieve remote code execution (RCE) on both Linux and Windows platforms. The module includes logic to fingerprint the target version using the /api/server/version endpoint and selects the appropriate gadget chain based on the detected version. The exploit is weaponized, supporting arbitrary command execution as a Metasploit payload, and does not require authentication. The code is well-structured, with clear separation of version detection, exploit logic, and payload delivery. The default configuration targets port 8443 over SSL, but these can be customized. The module is suitable for both proof-of-concept and operational exploitation.