CVE-2023-43208criticalunder attackransomwareCWE-502CWE-78

CVE-2023-43208

Published · Updated

Follow this CVE+ Monitor Mirth Connect

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 86%
from disclosure to weapon141 days
Published on NVDOct 26
1st PoC+141d
metasploitOct 25
CISA KEV+207d
Action required by CISAfederal deadline: 2024-06-10

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

NextGen Healthcare Mirth Connect versions before 4.4.1 allow attackers to run arbitrary code on the server without authentication. This is a critical flaw because anyone on the internet can compromise the entire system.

Technical detail

Unauthenticated remote code execution in Mirth Connect pre-4.4.1 via unsafe deserialization (CWE-502) and command injection (CWE-78). The vulnerability stems from an incomplete patch of CVE-2023-37679, allowing attackers to execute arbitrary commands with server privileges without prior authentication or user interaction.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the incomplete patch of CVE-2023-37679.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
public PoCs found — 30
githubgithub.com/K3ysTr0K3R/CVE-2023-43208-EXPLOIT★ 29githubgithub.com/jakabakos/CVE-2023-43208-mirth-connect-rce-poc★ 7githubgithub.com/MKIRAHMET/PoC-2023-43208★ 3githubgithub.com/kyakei/CVE-2023-43208★ 3githubgithub.com/Avento/CVE-2023-43208_Detection_PoC★ 2githubgithub.com/az4rvs/Mirth-Connect-CVE-2023-43208★ 2githubgithub.com/Criz117/CVE-2023-43208-PoC★ 1githubgithub.com/predyy/CVE-2023-43208★ 1githubgithub.com/Pegasus0xx/CVE-2023-43208★ 1githubgithub.com/D3m0nicw0lf/CVE-2023-43208★ 0githubgithub.com/Humberto-pixel/CVE-2023-43208-PoC★ 0githubgithub.com/LunaLynx12/cve-2023-43208-poc★ 0githubgithub.com/J4F9S5D2Q7/CVE-2023-43208-MIRTHCONNECT★ 0githubgithub.com/4nuxd/CVE-2023-43208★ 0vulncheckvulncheck.com/xdb/0f7be8e5e0baunverifiedcve_referencepacketstormsecurity.com/files/176920/Mirth-Connect-4.4.0-Remote-Command-Execution.htmlunverifiedvulncheckvulncheck.com/xdb/a2aa68eba708unverifiedvulncheckvulncheck.com/xdb/ee5e1ec1b051unverifiedvulncheckvulncheck.com/xdb/5d0f4efbe9bbunverifiedvulncheckvulncheck.com/xdb/467a9c5dfc03unverifiedvulncheckvulncheck.com/xdb/7cd9ef4cb744unverifiedvulncheckvulncheck.com/xdb/97838f814856unverifiedvulncheckvulncheck.com/xdb/d6c610b2aa6aunverifiedvulncheckvulncheck.com/xdb/d77b6af4ded3unverifiedvulncheckvulncheck.com/xdb/356b98efe4c2unverifiedvulncheckvulncheck.com/xdb/0031e5e69525unverifiedvulncheckvulncheck.com/xdb/50547c2b4d2aunverifiedvulncheckvulncheck.com/xdb/614ca36ed033unverifiedvulncheckvulncheck.com/xdb/d7624f302c9eunverifiedvulncheckvulncheck.com/xdb/af195baddffeunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.