Mirth Connect CVE-2023-43208: Unauthenticated RCE, Exploited

What to do

1. Query every Mirth Connect server's version with GET /api/server/version and the X-Requested-With: OpenAPI header.
2. Upgrade anything below 4.4.1 to a current supported release; 4.4.0 is not enough because its fix for CVE-2023-37679 was bypassable.
3. Restrict the Mirth Connect API and administrator port to a management network or VPN.
4. Run the service under a dedicated low-privilege account rather than SYSTEM or root.
5. If a server was reachable and below 4.4.1 at any time since January 2024, treat it as possibly compromised and rotate the credentials and keys it holds.

How to check if you are affected or compromised

• Search web proxy or load balancer logs for POST requests with Content-Type application/xml to /api/users and other /api/ endpoints from unexpected sources.
• Look for the Mirth Connect Java process spawning cmd.exe, powershell.exe, sh or bash.
• Review the host for remote management tools, new local accounts and scheduled tasks you did not install; ransomware crews commonly add these after initial access.
• Use EDR telemetry to check for outbound connections from the Mirth host to unfamiliar addresses.

What happened#

Mirth Connect is an open-source interface engine that moves HL7 and other clinical data between hospital systems. On October 17, 2023, NextGen Healthcare released version 4.4.1 to fix CVE-2023-43208, an unauthenticated remote code execution flaw. The 4.4.1 release notes say the fix changed how Mirth's XStream library filters types, from a denylist to an allowlist of only the classes Mirth needs.

Horizon3.ai found the bug while checking the fix for an earlier flaw, CVE-2023-37679, in version 4.4.0. Its October 25, 2023 disclosure says that patch could be bypassed. The 4.4.0 notes had said only installs on Java 8 or below were at risk, but Horizon3 found every install was vulnerable regardless of Java version. The CVE record calls it the result of "the incomplete patch of CVE-2023-37679", and NVD scores it 9.8. On January 12, 2024, Horizon3 published a full write-up with a working proof of concept. It sends an XML XStream gadget chain to POST /api/users with the header X-Requested-With: OpenAPI, and Horizon3 notes many other endpoints also unmarshal XML.

CISA added the CVE to the KEV catalog on May 20, 2024, with a June 10 deadline, and now marks it as known to be used in ransomware campaigns. SecurityWeek reported that a Microsoft report on first-quarter 2024 ransomware named Mirth Connect among the flaws used for initial access by Storm-1175, a China-based actor known for deploying Medusa ransomware.

Who is affected#

All Mirth Connect versions before 4.4.1. Horizon3 confirmed builds going back to 2015/2016. It counted about 1,200 internet-exposed hosts in October 2023, and SecurityWeek cites Shadowserver seeing more than 440 apparently vulnerable instances days after the PoC. On Windows, where Horizon3 says Mirth is most common, the service typically runs as SYSTEM, so a successful exploit owns the host.

Do you really need to act?#

If you are on 4.4.1 or later, you are not exposed to this bug, and the verdict is check exposure. But Mirth servers often sit untouched for years because "the interfaces work." The exploit is a single unauthenticated HTTP request, it is public, and ransomware crews have used it. A healthcare network that still has a pre-4.4.1 instance anywhere should treat it as urgent. Upgrading also does not remove access an attacker already set up.

What to do now#

1. Find every instance and check its version: curl -k -H 'X-Requested-With: OpenAPI' https://mirth.example.org:8443/api/server/version. Horizon3 says anything below 4.4.1 is highly likely to be exploitable.
2. Upgrade to 4.4.1 or later. Do not stop at 4.4.0.
3. Limit the API and administrator port to a management network or VPN.
4. Run the service under a dedicated low-privilege account.
5. If an instance was reachable and unpatched at any time since January 2024, rotate the database, interface and service credentials it stores.

How to tell if you were hit#

• Search proxy and load balancer logs for POST /api/users, and other XML POSTs to /api/, from sources that are not your admins.
• Check EDR process trees for the Mirth Java process launching cmd.exe, powershell.exe, sh or bash.
• Look for remote management tools, new local accounts and scheduled tasks nobody installed.
• Review outbound connections from the Mirth host to unfamiliar addresses.

Timeline#

• Sep 8, 2023 — Horizon3 reports the bypass to NextGen.
• Oct 17, 2023 — NextGen releases Mirth Connect 4.4.1.
• Oct 25, 2023 — Horizon3 publishes its disclosure.
• Jan 12, 2024 — Horizon3 publishes technical details and a PoC.
• May 20, 2024 — CISA adds CVE-2023-43208 to KEV.

Vulnerability records

• CVE-2023-43208 · KEV 2024-05-20 · NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. NextGen Healthcare — Mirth Connect 4.4.1: What's New github.com
2. Horizon3.ai — NextGen Mirth Connect Remote Code Execution Vulnerability (CVE-2023-43208) horizon3.ai
3. Horizon3.ai — Writeup for CVE-2023-43208: NextGen Mirth Connect Pre-Auth RCE horizon3.ai
4. CVE record — CVE-2023-43208 cve.org
5. NVD — CVE-2023-43208 nvd.nist.gov
6. CISA — Known Exploited Vulnerabilities: CVE-2023-43208 cisa.gov

Coverage and analysis

1. SecurityWeek — CISA Warns of Attacks Exploiting NextGen Healthcare Mirth Connect Flaw securityweek.com