Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

FeedsContactPrivacy© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2023-43208-EXPLOIT — A PoC exploit for CVE-2023-43208 - Mirth Connect Remote Code Execution (RCE) | Kitploit
Tools/GitHubGitHub/k3ystr0k3r/cve-2023-43208-exploit
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingRemote Access Tool
GitHubk3ystr0k3r/cve-2023-43208-exploit

CVE-2023-43208-EXPLOIT

A PoC exploit for CVE-2023-43208 - Mirth Connect Remote Code Execution (RCE)

View Repository
291025 months agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2023-43208 - Mirth Connect Remote Code Execution (RCE) Exploit 🚨

Introduction 📖

This repository contains a Proof-of-Concept (PoC) exploit for a critical vulnerability in NextGen Healthcare Mirth Connect versions prior to 4.4.1. The vulnerability, tracked as CVE-2023-43208, allows for unauthenticated remote code execution (RCE) on systems running the vulnerable software versions.

Mirth Connect, an open-source healthcare integration engine, failed to properly handle deserialized data, making it susceptible to arbitrary OS command execution through specially crafted HTTP requests. The vulnerability was discovered following an incomplete patch for CVE-2023-37679, initially addressed by IHTeam. Subsequent research by Horizon3.ai revealed a bypass to the deny list implemented in the original patch, leading to the identification of CVE-2023-43208. This exploit module has been successfully tested against Mirth Connect versions 4.1.1, 4.3.0, and 4.4.0.

Disclaimer ⚠️

The provided Proof-of-Concept (PoC) and exploit code is for educational and research purposes only. Unauthorized testing and misuse of this PoC exploit against systems without explicit consent is illegal and strictly prohibited. The author assumes no responsibility for any misuse or damage caused by this tool.

By using this exploit, you agree to use it in an ethical and legal manner. Testing should only be performed on systems where explicit permission has been given.

Prerequisites 🛠️

  • Python 3.10 or higher
  • requests Python library
  • pwncat-cs Python library
  • rich Python library

Usage 💻

To use the exploit, clone this repository and navigate to the project directory. You can then run the exploit script as follows:

pip install -r requirements.txt
python3 CVE-2023-43208.py -u <Target URL> -lh <Listening Host> -lp <Listening Port>

Optional arguments include:

  • -f/--file to specify a file containing target URLs for batch scanning.
  • -o/--output to specify an output file for saving scan results.
  • -t/--threads to set the number of threads for concurrent scanning.

Features ✨

  • Single target exploitation
  • Batch scanning and exploitation from a file
  • Customizable listening host and port for reverse shell connection
  • Multi-threaded scanning capability
  • Detailed console output with rich formatting

Contribution 🤝

Contributions, feature requests, and suggestions are welcome! Please feel free to open issues or submit pull requests.

Acknowledgments 🙏

  • Original vulnerability discovery: IHTeam
  • Patch analysis and CVE-2023-43208 discovery: Horizon3.ai
Download Tool