Unauthenticated RCE in NextGen Healthcare Mirth Connect

This repository contains a small Python-based exploit set targeting CVE-2023-43208 in Mirth Connect. The main exploit file, CVE-2023-43208.py, is the primary entry point and implements an operational remote code execution exploit against vulnerable Mirth Connect versions prior to 4.4.1. It constructs a malicious XML payload designed to trigger XStream deserialization and leverage an Apache Commons Collections-style gadget chain. The chain ultimately calls java.lang.Runtime.exec() to execute a base64-wrapped bash reverse shell command. The exploit then POSTs this XML to the target endpoint /api/users using requests with SSL verification disabled and attacker-controlled URL, lhost, and lport parameters. Repository structure is minimal: CVE-2023-43208.py is the exploit, payload.py is a separate helper payload generator, README.md documents usage in Spanish, and requirements.txt lists requests and rich. The helper script payload.py is not required for the main exploit path; it interactively generates a Python reverse shell one-liner, base64-encodes it, and embeds it into XML sent to http://127.0.0.1:54321/addPatient. That appears to be an auxiliary or unrelated local-service payload generator rather than part of the core CVE-2023-43208 exploitation flow. Overall purpose: exploit vulnerable Mirth Connect instances over HTTP(S) by sending crafted XML to /api/users and obtain remote shell access via a reverse connection. The code is more than a simple detector and includes a working payload, but it is still a standalone PoC/operational script rather than a framework-integrated or highly modular weaponized exploit.

This repository is a small standalone Python proof-of-concept exploit for CVE-2023-43208 targeting NextGen Healthcare Mirth Connect versions earlier than 4.4.1. The repository contains three files: the main exploit script (CVE-2023-43208.py), a short README with setup and usage examples, and a pinned requirements.txt. The exploit is not part of a larger framework. The main script first performs a version check by sending an unauthenticated GET request to /api/server/version. It compares the returned version string against 4.4.1 using Python's packaging.version module. If the target appears vulnerable, it can proceed in one of two modes: execute a single arbitrary command supplied with -c, or generate a bash reverse shell using attacker-supplied -l/-p values. The exploitation path sends a crafted XML document via POST to /api/users. The XML embeds a Java gadget chain referencing Apache Commons Lang and Commons Collections classes, ultimately invoking java.lang.Runtime.exec() on the target. To improve reliability, the script base64-encodes commands and wraps them in a bash -c decode-and-execute pattern, avoiding issues with special characters and shell metacharacters. In reverse shell mode, the decoded command is a standard bash TCP callback to /dev/tcp/LHOST/LPORT. Operationally, the exploit disables TLS verification warnings, uses a browser-like User-Agent, and treats HTTP 500 responses as potentially successful because the target may crash or reset the connection after command execution. This is a real exploit rather than a detector: it includes both vulnerability checking and active unauthenticated RCE capability. The code is concise and usable as-is, but payload customization is limited to arbitrary command strings or a hardcoded bash reverse shell pattern, making the maturity best described as OPERATIONAL.

Repository contains a single Python proof-of-concept exploit (exploit.py) plus a short README. The script targets CVE-2023-43208 in Mirth Connect, performing pre-auth remote code execution by POSTing a crafted XStream XML gadget chain to the Mirth REST API endpoint /api/users. The payload leverages Apache Commons Collections4 transformers and org.apache.commons.lang3.event.EventUtils$EventBindingInvocationHandler to invoke java.lang.Runtime.getRuntime().exec() with a user-provided command; it supports a simple platform switch to wrap commands with cmd.exe /c on Windows. Network behavior: one HTTPS POST to <base_url>/api/users with Content-Type: application/xml and X-Requested-With: OpenAPI; TLS certificate verification is disabled. The script treats HTTP 500 as an indicator that deserialization likely occurred (gadget chain exception), otherwise prints status and up to 500 bytes of response.

Repository contains a single Python exploit tool for CVE-2023-43208 (Mirth Connect / NextGen Connect) plus a README and requirements file. Structure: - CVE-2023-43208.py: Main exploit/scanner. Implements (1) dependency auto-install via pip, (2) target fingerprinting/version check using the Mirth API version endpoint, (3) exploitation by sending a crafted XML payload to /api/users to trigger unauthenticated Java deserialization RCE, and (4) an attacker-side reverse-shell listener that upgrades the session to an interactive PTY using only Python stdlib (socket/select/tty/termios) and pushes terminal sizing (stty rows/cols). - README.md: Describes the vulnerability (unauthenticated RCE via XML deserialization with Apache Commons Collections gadget chain), affected versions (<4.4.1), and usage for single-target exploitation and bulk scanning. - Requirements.txt: requests, packaging, rich, alive-progress. Capabilities: - Unauthenticated network RCE against vulnerable Mirth Connect instances. - Reverse shell callback handling with automatic PTY upgrade and interactive terminal support. - Bulk scanning of multiple URLs with threading and progress bar; optional output of vulnerable targets. Notable operational details: - Uses HTTP(S) requests (requests with warnings disabled) and custom headers including X-Requested-With: OpenAPI and Content-Type: application/xml. - Listener binds to 0.0.0.0 on the chosen port; supports a bind-port override intended for tunneling setups (e.g., ngrok). Overall, this is an operational exploit tool (not just detection) that both identifies vulnerable Mirth Connect versions and delivers an RCE payload to obtain an interactive shell.

Repository contains a single Python exploit script and a README. - Purpose: Exploit CVE-2023-43208, an unauthenticated XStream deserialization RCE in NextGen Mirth Connect (noted as related to an incomplete patch for CVE-2023-37679), affecting versions prior to 4.4.1 (per README). - Structure: - README.md: Describes the vulnerability, affected versions, and usage: `python3 mirth_rce.py https://{target} <attacker_host> <attacker_port>`. - mirth_rce.py: Standalone exploit. It disables TLS warnings, takes CLI args (target base URL, LHOST, LPORT), and POSTs a crafted XML payload to `/<base>/api/users` with headers `X-Requested-With: OpenAPI` and `Content-Type: application/xml`. - Exploit mechanics/capabilities: - Network-based, unauthenticated POST to the Mirth Connect API endpoint. - Delivers an XML payload designed to be deserialized by XStream, using a gadget chain involving `EventUtils$EventBindingInvocationHandler` and `ChainedTransformer` to reach `java.lang.ProcessBuilder`. - Executes a hardcoded bash reverse shell command that connects back to the attacker at the provided host/port. - No verification of success is implemented (exceptions are swallowed; script prints "Enjoy.").

Repository contains a Python proof-of-concept exploit for CVE-2023-43208 targeting NextGen Healthcare Mirth Connect. Structure is minimal: README.md documents usage and behavior; exp.py implements the exploit. exp.py defines a MirthConnectExploit class that (1) normalizes the target URL (defaults to HTTPS, optional --http), (2) fingerprints Mirth Connect by requesting the base page and searching for the string 'Mirth Connect Administrator', (3) queries /api/server/version and checks if the returned semantic version is below 4.4.1, and (4) if vulnerable, POSTs a crafted XML payload to /api/users. The payload is an XML-serialized gadget chain leveraging Apache Commons Collections4 and Apache Commons Lang3 EventUtils invocation handler to reach java.lang.Runtime.exec(). The executed command is a bash reverse shell that connects back to the operator-supplied LHOST and LPORT. The script disables TLS certificate verification, prompts the user for confirmation before sending the payload, and prints listener guidance (nc -lvnp <port>).

Repository contains a standalone Python exploit for NextGen Mirth Connect targeting CVE-2023-43208 (and referencing CVE-2023-37679). The main file (CVE-2023-43208.py) builds an XML payload that leverages a Java gadget chain (Apache Commons Collections4 + Commons Lang3 EventUtils invocation handler) to invoke java.lang.Runtime.exec() on the server. It sends the payload via an unauthenticated HTTP POST to the Mirth Connect API endpoint /api/users with headers Content-Type: application/xml and X-Requested-With: OpenAPI, with TLS verification disabled. Capabilities: - Arbitrary command execution (one-shot) on the target host; optional Windows command wrapping using cmd.exe /c. - Reverse shell mode: if -lh/-lp are provided, it auto-generates a bash /dev/tcp reverse shell command to connect back to the attacker. - Includes a simple built-in TCP listener (binds 0.0.0.0:<port>) to accept a single incoming connection and print received data. Repository structure: - CVE-2023-43208.py: exploit implementation, CLI parsing, payload generation, HTTP delivery, optional listener. - README.md: high-level vulnerability description and affected versions (claims up to 4.4.0; fixed in 4.4.1). - use.txt: usage examples for command execution and reverse shell (notes using netcat externally; script also has its own listener).

Repository contains a single Python exploit script (mirth_rce.py) and a README describing CVE-2023-43208 (unauthenticated RCE in NextGen Mirth Connect via XStream deserialization, affecting versions prior to 4.4.1). Structure & purpose: - README.md: documents the vulnerability, affected versions, and usage: python3 mirth_rce.py https://{target} <attacker_host> <attacker_port>. - mirth_rce.py: operational exploit that sends a crafted application/xml payload to the Mirth Connect API endpoint /api/users with header X-Requested-With: OpenAPI. The XML is an XStream gadget chain leveraging Apache Commons Collections4 transformers and EventUtils invocation handler to construct java.lang.ProcessBuilder and execute a bash reverse shell command. Exploit capabilities: - Unauthenticated network-based RCE by triggering unsafe deserialization. - Spawns a reverse shell from the target to the attacker-supplied host/port. - Uses requests.post with TLS verification disabled (verify=False) and a short timeout; it does not validate success (fire-and-forget). Notable observables: - HTTP(S) POST to {target}/api/users with Content-Type: application/xml and X-Requested-With: OpenAPI. - Reverse shell command uses /dev/tcp/{lhost}/{lport} for callback.

Repository contains a Python proof-of-concept/operational exploit for CVE-2023-43208 (Mirth Connect unauthenticated XML deserialization RCE). Structure: (1) PoC.py is the main tool implementing interactive and CLI-driven exploitation plus a multi-threaded scanner; (2) README.md documents affected versions (<4.4.1), usage modes (single target exploit, file-based scanning, non-interactive), and defensive guidance; (3) requirements.txt lists Python dependencies (requests, packaging, rich, alive-progress, urllib3); (4) .gitignore excludes typical Python/IDE artifacts and the scan input/output files. Core capabilities observed in code/README: it fingerprints targets by requesting /api/server/version and comparing versions (via packaging.version) to decide vulnerability; it can scan many targets concurrently using ThreadPoolExecutor and show progress with alive-progress, optionally writing vulnerable hosts to an output file. For exploitation, it targets the /api/users endpoint with an XML payload intended to trigger deserialization (Commons Collections gadget chain per README) and execute attacker-controlled commands that connect back to the provided LHOST/LPORT (reverse shell/callback). The tool also includes a basic web-page check for the string "Mirth Connect Administrator" to confirm an instance is present.

Repository is a small C++20 proof-of-concept exploit for CVE-2023-43208 (Mirth Connect XStream deserialization RCE). Structure: (1) Makefile builds a single binary named "exploit" linking OpenSSL and pthread; (2) README.md documents affected versions (<= 4.4.0) and usage: ./exploit <URL> <LHOST> <LPORT>; (3) src/main.cpp contains all exploit logic using cpp-httplib with OpenSSL support. Operational flow in src/main.cpp: it constructs an HTTP(S) client to the user-supplied base URL, disables TLS certificate/hostname verification, and performs a vulnerability check by GETing /api/server/version with header X-Requested-With: OpenAPI. It considers the target vulnerable only if the response body contains the hardcoded string "4.4.0" (note: this is a simplistic check and may miss other vulnerable versions). If the check passes, it builds a malicious XML payload (sorted-set + dynamic-proxy) embedding an Apache Commons Collections4 gadget chain via org.apache.commons.lang3.event.EventUtils$EventBindingInvocationHandler and ChainedTransformer to reach java.lang.Runtime.exec(). The executed command is a bash reverse shell using /dev/tcp to connect back to <LHOST>:<LPORT>. The payload is delivered via POST to /api/users with Content-Type application/xml. The exploit treats an HTTP 500 response as success (common when deserialization triggers an exception after code execution).

Repository contains a single Python exploit (exploit.py) plus documentation (README.md) targeting CVE-2023-43208: a pre-auth remote code execution vulnerability in NextGen Healthcare Mirth Connect versions < 4.4.1. The exploit sends a crafted XStream XML payload to the unauthenticated POST /api/users endpoint. The payload is a deserialization gadget chain that bypasses the prior denylist-based fix for CVE-2023-37679 by using org.apache.commons.lang3.event.EventUtils$EventBindingInvocationHandler (dynamic proxy handler) together with Apache Commons Collections4 transformers (ChainedTransformer/ConstantTransformer/InvokerTransformer) to invoke java.lang.Runtime.getRuntime().exec(command). Key capabilities implemented via argparse subcommands: - check: fingerprints the target (uses /api/server/version) and assesses likely vulnerability. - exec: performs blind command execution (no command output expected). - shell: triggers a reverse shell back to attacker-supplied --lhost/--lport and includes listener handling (socket/select/threading indicated by imports and CLI options). - scan: multi-target scanning from a file with configurable thread count and optional output of vulnerable hosts. Notable operational details: uses Python requests with TLS warnings disabled (suggesting self-signed certs common on :8443), sets headers including Content-Type: application/xml and X-Requested-With: OpenAPI, and builds/escapes XML to embed arbitrary commands safely into the serialized gadget chain.

This repository contains a single Metasploit module targeting Mirth Connect (NextGen) for two deserialization vulnerabilities: CVE-2023-37679 and CVE-2023-43208. The exploit leverages crafted XML payloads sent via POST requests to the /api/users endpoint, exploiting insecure deserialization to achieve remote code execution (RCE) on both Linux and Windows platforms. The module includes logic to fingerprint the target version using the /api/server/version endpoint and selects the appropriate gadget chain based on the detected version. The exploit is weaponized, supporting arbitrary command execution as a Metasploit payload, and does not require authentication. The code is well-structured, with clear separation of version detection, exploit logic, and payload delivery. The default configuration targets port 8443 over SSL, but these can be customized. The module is suitable for both proof-of-concept and operational exploitation.

This repository contains exploit and detection scripts for two critical vulnerabilities (CVE-2023-37679 and CVE-2023-43208) in NextGen's Mirth Connect, a widely used healthcare integration engine. The vulnerabilities allow unauthenticated remote code execution via a crafted XML payload sent to the /api/users endpoint. The repository includes two main exploit scripts (CVE-2023-37679.py and CVE-2023-43208.py), each generating a different Java deserialization payload to achieve command execution on both Unix and Windows platforms. The detection.py script checks if a target Mirth Connect instance is vulnerable by querying its version via the /api/server/version endpoint. The README provides background, usage instructions, and context for the vulnerabilities. The exploit scripts are operational, requiring only the target URL and a command to execute, and do not require authentication. The main attack vector is network-based, targeting HTTP(S) endpoints exposed by Mirth Connect.

This repository provides a Python-based proof-of-concept exploit for CVE-2023-43208, a critical unauthenticated remote code execution vulnerability in NextGen Healthcare Mirth Connect versions prior to 4.4.1. The main script, CVE-2023-43208.py, allows an attacker to target a vulnerable Mirth Connect instance by sending a specially crafted XML payload to the /api/users endpoint, exploiting improper deserialization to execute arbitrary OS commands. The exploit can be used against a single target or in batch mode using a file of URLs. If successful, it establishes a reverse shell connection to the attacker's specified host and port. The script also includes functionality to fingerprint the target's version via the /api/server/version endpoint and only proceeds if the version is vulnerable. The repository includes a README with usage instructions and a requirements.txt for dependencies. The exploit is a functional PoC and does not appear to be weaponized or part of a larger framework.