CVE-2023-43208: Nextgen Mirth Connect RCE Vulnerability

CVE-2023-43208 Overview

NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. This vulnerability exists due to an incomplete patch for CVE-2023-37679, allowing attackers to execute arbitrary code on affected systems without authentication. Given Mirth Connect's role as a healthcare integration engine used for exchanging sensitive medical data, successful exploitation could lead to severe consequences including unauthorized access to protected health information (PHI), lateral movement within healthcare networks, and complete system compromise.

Critical Impact

This vulnerability enables unauthenticated attackers to achieve remote code execution on systems running vulnerable versions of Mirth Connect. The vulnerability is actively exploited in the wild and has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog.

Affected Products

• NextGen Mirth Connect versions prior to 4.4.1

Discovery Timeline

• 2023-10-26 - CVE-2023-43208 published to NVD
• 2025-10-31 - Last updated in NVD database

Technical Details for CVE-2023-43208

Vulnerability Analysis

This vulnerability (CWE-78: OS Command Injection) represents an incomplete fix for the previously disclosed CVE-2023-37679. The flaw allows unauthenticated remote attackers to execute arbitrary operating system commands on the underlying server hosting Mirth Connect. Healthcare organizations deploying Mirth Connect as their integration engine are particularly at risk, as successful exploitation could provide attackers with a foothold into sensitive healthcare infrastructure.

The vulnerability stems from insufficient input validation and sanitization in the application's handling of user-supplied data. When exploited, attackers can inject malicious commands that are executed with the privileges of the Mirth Connect service account, potentially leading to full system compromise.

Root Cause

The root cause is an incomplete security patch for CVE-2023-37679. The original vulnerability allowed command injection, but the remediation applied in earlier versions failed to address all attack vectors. This left a bypass path that attackers could leverage to achieve the same unauthenticated remote code execution impact as the original vulnerability.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker with network access to a vulnerable Mirth Connect instance can craft malicious requests that exploit the command injection flaw. The vulnerability affects the application's request processing components, where unsanitized input can be interpreted as system commands.

Exploitation involves sending specially crafted HTTP requests to the Mirth Connect server. The injected commands execute in the context of the service account running Mirth Connect, which often has elevated privileges on healthcare systems. For detailed technical analysis, see the Horizon3 Analysis on CVE-2023-43208.

Detection Methods for CVE-2023-43208

Indicators of Compromise

• Unusual outbound network connections from Mirth Connect servers to unknown external hosts
• Unexpected process spawning from the Mirth Connect Java process (e.g., shell processes like cmd.exe, /bin/sh, or /bin/bash)
• Modified system files or new suspicious files in Mirth Connect installation directories
• Anomalous HTTP request patterns in Mirth Connect access logs containing shell metacharacters or encoded command sequences

Detection Strategies

• Deploy network intrusion detection signatures for known CVE-2023-43208 exploitation patterns
• Monitor Mirth Connect logs for malformed or suspicious HTTP requests targeting vulnerable endpoints
• Implement endpoint detection rules to alert on unexpected child processes spawned by the Mirth Connect service
• Conduct regular vulnerability scanning to identify unpatched Mirth Connect instances in your environment

Monitoring Recommendations

• Enable comprehensive logging on all Mirth Connect instances including HTTP access logs and application logs
• Configure SIEM alerts for command injection patterns in web application traffic destined to Mirth Connect servers
• Monitor for lateral movement activity originating from systems hosting Mirth Connect
• Review the CISA Known Exploited Vulnerabilities Catalog for updated threat intelligence

How to Mitigate CVE-2023-43208

Immediate Actions Required

• Upgrade all Mirth Connect instances to version 4.4.1 or later immediately
• If immediate patching is not possible, restrict network access to Mirth Connect administrative interfaces using firewall rules or network segmentation
• Conduct incident response investigation on any internet-exposed Mirth Connect instances to check for signs of compromise
• Review and harden service account permissions used by Mirth Connect deployments

Patch Information

NextGen Healthcare has released Mirth Connect version 4.4.1 which addresses this vulnerability. Organizations should upgrade to this version or later as soon as possible. Given the active exploitation of this vulnerability and its inclusion in CISA's KEV catalog, patching should be treated as an urgent priority. Refer to the Packet Storm advisory for additional technical details on the vulnerability and remediation.

Workarounds

• Implement strict network access controls to limit connectivity to Mirth Connect servers to only authorized systems and users
• Deploy a web application firewall (WAF) with rules to detect and block command injection attempts
• Place Mirth Connect behind a reverse proxy with input validation and request filtering capabilities
• Segment Mirth Connect servers from critical healthcare systems and restrict their access to only necessary resources

# Example: Restrict network access to Mirth Connect using iptables
# Allow access only from trusted management network (adjust IP ranges as needed)
iptables -A INPUT -p tcp --dport 8443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8443 -j DROP