---
title: "Mirth Connect CVE-2023-43208: Unauthenticated RCE, Exploited"
url: https://erroneo.us/security/briefs/mirth-connect-cve-2023-43208-xstream-rce/
description: "Healthcare interface engine Mirth Connect before 4.4.1 allowed unauthenticated RCE via XStream; used for ransomware access. Confirm 4.4.1+ and hunt."
type: security-brief
section: "Security Digest"
date_published: 2023-10-17
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2023-43208"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Mirth Connect CVE-2023-43208: Unauthenticated RCE, Exploited

**Verdict: Check exposure.** Fixed in October 2023 with a public exploit since January 2024; any Mirth Connect still below 4.4.1 is an open door, and any that was reachable and unpatched in early 2024 needs a compromise check.

- **Who must act:** Hospitals, labs, health IT vendors and integrators running Mirth Connect below 4.4.1, above all where the API or admin port is reachable from the internet or a broad internal network.
- **Who can relax:** Teams that upgraded Mirth Connect to 4.4.1 or later in late 2023 and expose its API only to a small management network.
- **Affected:** Mirth Connect before 4.4.1 (versions back to at least 2015/2016 per Horizon3, on any Java version)
- **Fixed:** Mirth Connect 4.4.1 (Oct 17, 2023) and later
- **CVEs:** CVE-2023-43208
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Query every Mirth Connect server's version with GET /api/server/version and the X-Requested-With: OpenAPI header.
2. Upgrade anything below 4.4.1 to a current supported release; 4.4.0 is not enough because its fix for CVE-2023-37679 was bypassable.
3. Restrict the Mirth Connect API and administrator port to a management network or VPN.
4. Run the service under a dedicated low-privilege account rather than SYSTEM or root.
5. If a server was reachable and below 4.4.1 at any time since January 2024, treat it as possibly compromised and rotate the credentials and keys it holds.

### How to check if you are affected

- Search web proxy or load balancer logs for POST requests with Content-Type application/xml to /api/users and other /api/ endpoints from unexpected sources.
- Look for the Mirth Connect Java process spawning cmd.exe, powershell.exe, sh or bash.
- Review the host for remote management tools, new local accounts and scheduled tasks you did not install; ransomware crews commonly add these after initial access.
- Use EDR telemetry to check for outbound connections from the Mirth host to unfamiliar addresses.

## What happened

Mirth Connect is an open-source interface engine that moves HL7 and other clinical data between hospital systems. On October 17, 2023, NextGen Healthcare released version 4.4.1 to fix CVE-2023-43208, an unauthenticated remote code execution flaw. The [4.4.1 release notes](https://github.com/nextgenhealthcare/connect/wiki/4.4.1---What%27s-New) say the fix changed how Mirth's XStream library filters types, from a denylist to an allowlist of only the classes Mirth needs.

Horizon3.ai found the bug while checking the fix for an earlier flaw, CVE-2023-37679, in version 4.4.0. Its [October 25, 2023 disclosure](https://www.horizon3.ai/nextgen-mirth-connect-remote-code-execution-vulnerability-cve-2023-43208/) says that patch could be bypassed. The 4.4.0 notes had said only installs on Java 8 or below were at risk, but Horizon3 found every install was vulnerable regardless of Java version. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2023-43208) calls it the result of "the incomplete patch of CVE-2023-37679", and [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-43208) scores it 9.8. On January 12, 2024, Horizon3 published a [full write-up with a working proof of concept](https://www.horizon3.ai/attack-research/disclosures/writeup-for-cve-2023-43208-nextgen-mirth-connect-pre-auth-rce/). It sends an XML XStream gadget chain to `POST /api/users` with the header `X-Requested-With: OpenAPI`, and Horizon3 notes many other endpoints also unmarshal XML.

CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-43208) on May 20, 2024, with a June 10 deadline, and now marks it as known to be used in ransomware campaigns. [SecurityWeek](https://www.securityweek.com/cisa-warns-of-attacks-exploiting-nextgen-healthcare-mirth-connect-flaw/) reported that a Microsoft report on first-quarter 2024 ransomware named Mirth Connect among the flaws used for initial access by Storm-1175, a China-based actor known for deploying Medusa ransomware.

## Who is affected

All Mirth Connect versions before 4.4.1. Horizon3 confirmed builds going back to 2015/2016. It counted about 1,200 internet-exposed hosts in October 2023, and SecurityWeek cites Shadowserver seeing more than 440 apparently vulnerable instances days after the PoC. On Windows, where Horizon3 says Mirth is most common, the service typically runs as SYSTEM, so a successful exploit owns the host.

## Do you really need to act?

If you are on 4.4.1 or later, you are not exposed to this bug, and the verdict is check exposure. But Mirth servers often sit untouched for years because "the interfaces work." The exploit is a single unauthenticated HTTP request, it is public, and ransomware crews have used it. A healthcare network that still has a pre-4.4.1 instance anywhere should treat it as urgent. Upgrading also does not remove access an attacker already set up.

## What to do now

1. Find every instance and check its version: `curl -k -H 'X-Requested-With: OpenAPI' https://mirth.example.org:8443/api/server/version`. Horizon3 says anything below 4.4.1 is highly likely to be exploitable.
2. Upgrade to 4.4.1 or later. Do not stop at 4.4.0.
3. Limit the API and administrator port to a management network or VPN.
4. Run the service under a dedicated low-privilege account.
5. If an instance was reachable and unpatched at any time since January 2024, rotate the database, interface and service credentials it stores.

## How to tell if you were hit

- Search proxy and load balancer logs for `POST /api/users`, and other XML POSTs to `/api/`, from sources that are not your admins.
- Check EDR process trees for the Mirth Java process launching `cmd.exe`, `powershell.exe`, `sh` or `bash`.
- Look for remote management tools, new local accounts and scheduled tasks nobody installed.
- Review outbound connections from the Mirth host to unfamiliar addresses.

## Timeline

- Sep 8, 2023 — Horizon3 reports the bypass to NextGen.
- Oct 17, 2023 — NextGen releases Mirth Connect 4.4.1.
- Oct 25, 2023 — Horizon3 publishes its disclosure.
- Jan 12, 2024 — Horizon3 publishes technical details and a PoC.
- May 20, 2024 — CISA adds CVE-2023-43208 to KEV.

## Sources

1. [NextGen Healthcare — Mirth Connect 4.4.1: What's New](https://github.com/nextgenhealthcare/connect/wiki/4.4.1---What%27s-New)
2. [Horizon3.ai — NextGen Mirth Connect Remote Code Execution Vulnerability (CVE-2023-43208)](https://www.horizon3.ai/nextgen-mirth-connect-remote-code-execution-vulnerability-cve-2023-43208/)
3. [Horizon3.ai — Writeup for CVE-2023-43208: NextGen Mirth Connect Pre-Auth RCE](https://www.horizon3.ai/attack-research/disclosures/writeup-for-cve-2023-43208-nextgen-mirth-connect-pre-auth-rce/)
4. [CVE record — CVE-2023-43208](https://www.cve.org/CVERecord?id=CVE-2023-43208)
5. [NVD — CVE-2023-43208](https://nvd.nist.gov/vuln/detail/CVE-2023-43208)
6. [CISA — Known Exploited Vulnerabilities: CVE-2023-43208](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-43208)
7. [SecurityWeek — CISA Warns of Attacks Exploiting NextGen Healthcare Mirth Connect Flaw](https://www.securityweek.com/cisa-warns-of-attacks-exploiting-nextgen-healthcare-mirth-connect-flaw/)

---
Source page: https://erroneo.us/security/briefs/mirth-connect-cve-2023-43208-xstream-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt