CVE-2023-43208 Vulnerability

What is CVE-2023-43208 vulnerability?

CVE-2023-43208 is an insecure deserialization vulnerability within the Mirth Connect API.

It allows an unauthenticated attacker to send a specially crafted XML payload to the server. Because the application fails to properly validate the data before "unmarshalling" (processing) it, the payload executes arbitrary Java code with the privileges of the Mirth Connect service (often SYSTEM or root).

This vulnerability is actually a patch bypass for a previous issue, CVE-2023-37679. The initial fix was incomplete, allowing attackers to find new ways to execute code.

When was it discovered?

The vulnerability was disclosed byHorizon3.ai researchers in October 2023. It was notably added to theCISA Known Exploited Vulnerabilities (KEV) catalog on May 20, 2024, confirming active exploitation in the wild.

Affected products & versions

This vulnerability impacts Mirth Connect versions that rely on an insecure implementation of the XStream library.

CVE-2023-43208 technical description

The core of the issue lies in how Mirth Connect uses the XStream Java library to convert XML data into Java objects.

In affected versions, the XmlMessageBodyReader class processes incoming XML requests before checking if the user is authenticated. This means any stranger on the internet can ask the server to process an XML file.

The previous patch (for CVE-2023-37679) attempted to fix this by creating a "denylist" of specific dangerous Java classes (like ProcessBuilder). However, attackers bypassed this by using other dangerous classes that weren't on the list, such as InvokerTransformer from the Apache Commons Collections library.

By chaining these allowed classes together, an attacker can construct a payload that the server dutifully executes, granting full remote control.

Tactics, techniques & procedures (TTPs)

Attackers, including the Chinese threat group Storm-1175 and various ransomware operators, utilize this vulnerability for Initial Access.

• Reconnaissance: Attackers scan for Mirth Connect login portals (often on ports 8080 or 8443) exposing the /api/server/version endpoint to confirm the software version.

• Exploitation: They send a POST request to an endpoint like /api/users. The body of the request contains the XML payload with the malicious XStream chain.

• Execution: The server deserializes the XML, executes the embedded command (often a PowerShell script or shell command), and establishes a connection back to the attacker.

• Impact: Since Mirth Connect handles sensitive patient data (PHI), this often leads tomassive data theft and ransomware deployment.

Indicators of compromise

• Network Traffic: Unexpected outbound connections from your Mirth Connect server, particularly to unknown external IPs or on ports associated with command and control (e.g., 80, 443, 445).

• Process Anomalies: The Mirth Connect Java process (java.exe or mcserver) spawning unexpected child processes like cmd.exe, powershell.exe, or /bin/bash.

• Log Entries: While successful exploitation can be quiet, failed attempts might generate com.thoughtworks.xstream.converters.ConversionException or SecurityException errors in the Mirth Connect server logs (mirth.log).

Known proof-of-concepts & exploits

Horizon3.ai released a detailed technical write-up and Proof-of-Concept (PoC) exploit in January 2024.

The exploit is highly reliable because it targets the fundamental way the application handles data, not a specific configuration. Automated exploit scripts are widely available in penetration testing toolkits and are actively used by threat actors.