Working PoCs for three NextGen Connect 4.5.2 vulnerabilities.
Working proof-of-concept exploits for three network-reachable vulnerabilities in NextGen Connect (Mirth Connect) 4.5.2. The harnesses run the official container image, create only the channel configuration needed by the finding, execute the attack from a separate container, and fail unless the claimed security effect is observed.
This review used the public Refute-or-Promote methodology and its open-source orchestration playbook. The method separates candidate generation from fresh-context adversarial review and requires empirical proof before promotion. The vulnerable 4.5.2 source and the review method are both public: anyone with ordinary model access, the source, and the ability to validate safely in a lab can apply the same process, and could have found these bug classes independently. Confidentiality around one report does not make the underlying review capability private.
These are real exploits, not parser unit tests. They recover a live password hash through SQL injection, exfiltrate target-local file contents through two distinct unauthenticated XML paths, and block bundled-Derby-backed operations until restart.
| CVE | Finding | Attacker | Demonstrated impact | CVSS 3.1 / 4.0 | PoC |
|---|---|---|---|---|---|
| CVE-2026-82583 | _getTables selectLimit injection | Authenticated API user | Password-table export to the public web root; bundled Derby freeze until restart | 8.3 / 7.2 | sql-selectlimit-injection/ |
| CVE-2026-78224 | XSLT Step XXE | Unauthenticated channel client | OOB read of a target-local file; channel-local slow-entity DoS | 8.2 / 8.8 | xslt-step-xxe/ |
| CVE-2026-82578 | XML Batch Adaptor XXE | Unauthenticated channel client | OOB read of a target-local file | 7.5 / 8.7 | xml-batch-xxe/ |
CVSS 3.1 and 4.0 are different standards; the paired scores are not a before-and-after comparison.
All three were reproduced against:
nextgenhealthcare/connect:4.5.2
sha256:4afa295cfe7c5ffd596efee69594157fea87202e33d66bb4a98a52db4598f836
NextGen privately reported that the XSLT issue was fixed in 4.7.1 and the SQL injection and XML Batch issues were fixed in 4.7.2. CISA advisory ICSMA-26-253-01 treats 4.7.1 and earlier as affected and recommends 4.7.2 or later. Releases after 4.5 are proprietary, so there is no public fixed image from which this repository can provide the same kind of reproducible negative control used for an open-source patch release.
An authenticated foothold on the administrative API becomes access to data the
account was not intended to export. The packaged exploit writes the live
PERSON_PASSWORD row beneath public_html and proves that the resulting file is
downloadable without authentication. The step that matters is going from a restricted API action to a file on disk that
no longer needs the attacker's session at all.
In a real integration environment, the database can describe channels, endpoints, and credentials used to reach databases, SFTP servers, mail relays, APIs, and other clinical systems. A separate controlled test recovered a deliberately planted connector password from exported channel XML. That makes the primitive useful for environment mapping and secret theft; use of any recovered credential against a downstream system was not tested and is not claimed.
The optional denial-of-service arm freezes the bundled Derby database. DB-backed API calls then time out, the same injection cannot unfreeze its own entrypoint, and a process restart is required. This is a practical recovery burden for Derby-backed installations, not proof that external production databases behave the same way.
Once an affected XSLT channel is deployed, the attacker needs no Mirth account. The incoming XML makes the service read a target-local file and send its contents to an attacker-controlled callback. This is useful even when the normal channel response does not contain the transformed data and the attacker cannot read message history.
The standalone client accepts a caller-selected single-line file: URI. Files such
as host identifiers, tokens, configuration fragments, or credentials are practically
valuable if the Mirth service account can read them and the server can reach the
callback. The packaged proof uses only a generated canary and does not claim universal
arbitrary-file recovery, multiline transport, or access beyond the service account.
A slow external entity also occupies the default one-thread victim channel. That can delay or stop the specific clinical interface mapped to that channel until the entity is released. The control channel and administrative API remain healthy, so this is channel-local disruption rather than a whole-server outage.
When an affected XML batch mode is enabled, an unauthenticated sender can use the raw batch body to trigger the same kind of outbound file disclosure. The server returns HTTP 500, but the attacker already has the target-only file content through the OOB callback. That makes the flaw practically useful as a blind exfiltration path even when response-code-only testing would dismiss the request as a parser failure.
Batch processing is off by default, the split mode must reach the XPath-backed parser, and server egress is required. This repository does not claim a demonstrated denial of service for CVE-2026-82578.
Requirements: Bash, Docker, x86-64 Linux, and network access for the initial image pull. Both images are digest-pinned. No host port is published; the target and attacker communicate only on a task-specific internal Docker bridge.
./run-all.sh
Or run a single finding:
./sql-selectlimit-injection/poc/run.sh
./xslt-step-xxe/poc/run.sh
./xml-batch-xxe/poc/run.sh
Each invocation creates uniquely named containers and a bridge network, records
evidence/current-run.log, and removes its own lab resources on exit. The checked-in
evidence/vulnerable-4.5.2.log files are transcripts from an x86-64 Linux replay.