CVE-2023-43208
NextGen Healthcare Mirth Connect Deserialization of Untrusted Data Vulnerability
Description
CVE-2023-43208 is a critical unauthenticated remote code execution vulnerability in NextGen Healthcare Mirth Connect before version 4.4.1, stemming from an incomplete patch for the earlier CVE-2023-37679. With a CVSS v3.1 base score of 9.8, the vulnerability allows an unauthenticated attacker to execute arbitrary code on the server hosting Mirth Connect, a widely used healthcare integration engine for exchanging data between clinical systems. CISA has added CVE-2023-43208 to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 10, 2024, with a confirmed ransomware association. Its EPSS score of 94.42% at the 100th percentile places it among the most actively exploited vulnerabilities globally, reflecting the critical danger to healthcare organizations using unpatched Mirth Connect instances.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| nextgen | mirth connect | < 4.4.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/176920/Mirth-Connect-4.4.0-Remote-Command-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://www.horizon3.ai/nextgen-mirth-connect-remote-code-execution-vulnerability-cve-2023-43208/(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-43208(US Government Resource)
Weakness Type
Unauthenticated Remote Code Execution via Deserialization
CVE-2023-43208 is an unauthenticated remote code execution vulnerability in NextGen Healthcare Mirth Connect that results from an incomplete security fix for CVE-2023-37679. The original vulnerability involved insecure Java deserialization that allowed remote code execution, and while the initial patch addressed some exploitation paths, it failed to completely remediate the underlying deserialization weakness. An attacker can send specially crafted serialized Java objects to the Mirth Connect server that, when deserialized, execute arbitrary commands on the underlying operating system without requiring any authentication. Java deserialization vulnerabilities in healthcare integration platforms are particularly dangerous because these systems typically have broad network access to clinical databases, electronic health record systems, and medical device interfaces. Learn more about deserialization vulnerabilities at CWE-502.
Impact Analysis
The impact of CVE-2023-43208 is catastrophic, with the CVSS vector reflecting the maximum possible severity for a remotely exploitable vulnerability. Confidentiality is fully compromised because unauthenticated remote code execution grants the attacker complete access to all data processed by Mirth Connect, which in healthcare environments includes protected health information (PHI), patient records, clinical laboratory results, medication data, insurance information, and HL7/FHIR messages containing the most sensitive categories of personal data.
Integrity faces maximum impact as the attacker can modify, inject, or delete data flowing through the integration engine. In a healthcare context, this could mean altering clinical results, modifying medication orders, corrupting patient records, or tampering with medical device data — any of which could have direct patient safety implications.
Availability is completely at risk since the attacker can shut down the integration engine, deploy ransomware to encrypt the server and connected systems, or disrupt the data flows between clinical systems that healthcare operations depend on. The confirmed ransomware association makes this an existential threat for healthcare organizations. The CVSS vector shows network accessibility (AV:N), low complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N), meaning any internet-exposed Mirth Connect instance is trivially exploitable. The EPSS score of 94.42% at the 100th percentile confirms massive ongoing exploitation.
Exploit Maturity
CVE-2023-43208 has reached maximum exploit maturity with publicly available exploits, confirmed active exploitation, and a direct ransomware association targeting healthcare organizations. CISA has included it in the Known Exploited Vulnerabilities catalog with an urgent remediation deadline of June 10, 2024. The EPSS score of 94.42% at the 100th percentile confirms that this is among the most aggressively targeted vulnerabilities in the global threat landscape.
Horizon3.ai published detailed vulnerability research at horizon3.ai, documenting how CVE-2023-43208 bypasses the incomplete fix for CVE-2023-37679 and demonstrating the exploitation path. A ready-to-use exploit was published on PacketStorm Security, making exploitation accessible to a wide range of threat actors.
The confirmed ransomware classification by CISA is particularly alarming given the healthcare sector context. Ransomware attacks against healthcare integration infrastructure can disrupt clinical operations across entire hospital networks, potentially affecting patient care and safety. The combination of trivial exploitation, no authentication requirement, and the high-value healthcare data accessible through Mirth Connect makes this a priority target for both ransomware operators and data theft campaigns.
Remediation
-
Upgrade Mirth Connect to version 4.4.1 or later immediately. This is the only complete fix for CVE-2023-43208. Note that the earlier fix for CVE-2023-37679 is incomplete and does not protect against this vulnerability. Download the update from the official NextGen Healthcare distribution channels.
-
Block all external network access to Mirth Connect. The Mirth Connect management interface and integration ports should never be directly accessible from the internet. Place the server behind a firewall and restrict access to only the specific internal systems that need to communicate with the integration engine. Use a VPN for any remote administrative access.
-
Assume compromise if Mirth Connect was internet-exposed while unpatched. Any Mirth Connect instance that was accessible from untrusted networks while running a version before 4.4.1 should be treated as potentially compromised. Conduct a thorough forensic investigation, examining system logs, network connections, file system changes, and any data access patterns that could indicate unauthorized access to patient data.
-
Assess and report potential PHI exposure. If compromise is confirmed or suspected, initiate your organization's breach notification procedures as required by HIPAA. Document the scope of potentially accessed patient data and engage legal counsel to determine reporting obligations to HHS, affected patients, and state regulators.
-
Implement network segmentation around healthcare integration systems. Isolate Mirth Connect and similar integration engines in a dedicated network segment with strict access controls. Monitor all traffic to and from the integration platform for anomalous patterns. Deploy intrusion detection systems tuned to detect Java deserialization attack signatures.
Technical Details
CVE-2023-43208 is an unauthenticated remote code execution vulnerability in NextGen Healthcare Mirth Connect with a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, resulting in the maximum critical base score of 9.8. The network attack vector (AV:N) means exploitation can occur from anywhere that can reach the Mirth Connect server. The low attack complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N) make this vulnerability trivially exploitable and fully automatable.
The vulnerability is rooted in insecure Java deserialization within Mirth Connect's network-facing services. Mirth Connect is a Java-based healthcare integration engine that processes HL7, FHIR, DICOM, and other healthcare data exchange formats. The server accepts serialized Java objects through its network interfaces, and prior to version 4.4.1, it failed to properly restrict the classes that could be deserialized. An attacker can send a crafted serialized Java object containing a gadget chain that, when deserialized by the server, triggers arbitrary command execution on the underlying operating system.
CVE-2023-43208 is specifically notable because it represents an incomplete fix bypass. The earlier CVE-2023-37679 addressed the same class of deserialization vulnerability, but the patch only blocked specific exploitation gadget chains without addressing the fundamental insecure deserialization pattern. Researchers at Horizon3.ai identified alternative gadget chains that bypassed the original fix, leading to this separate CVE assignment. The scope remains unchanged (S:U) but the full impact on confidentiality (C:H), integrity (I:H), and availability (A:H) reflects that successful exploitation grants the attacker the privileges of the Mirth Connect service account, which typically has broad access to healthcare databases and clinical systems. All Mirth Connect versions before 4.4.1 are affected.
Frequently Asked Questions
What is CVE-2023-43208?
CVE-2023-43208 is a critical unauthenticated remote code execution vulnerability in NextGen Healthcare Mirth Connect that allows an attacker to execute arbitrary commands on the server without any authentication. It has the maximum CVSS v3.1 score of 9.8 and results from an incomplete fix for the earlier CVE-2023-37679.
Is CVE-2023-43208 being used in ransomware attacks against healthcare?
Yes. CISA has confirmed a direct ransomware association for CVE-2023-43208. Ransomware operators are actively targeting Mirth Connect instances to gain initial access to healthcare networks, leveraging the unauthenticated remote code execution capability to deploy ransomware and disrupt clinical operations.
What is Mirth Connect and why is it a high-value target?
Mirth Connect is one of the most widely used open-source healthcare integration engines, processing data exchanges between electronic health records, laboratory systems, radiology systems, and other clinical applications. It handles sensitive patient data including HL7 and FHIR messages. Compromising Mirth Connect gives attackers access to vast amounts of protected health information and a pivotal position within the healthcare network.
Was the earlier patch for CVE-2023-37679 sufficient?
No. The patch for CVE-2023-37679 was incomplete and only blocked specific exploitation paths while leaving the underlying insecure deserialization vulnerability intact. CVE-2023-43208 demonstrates that alternative exploitation techniques bypass the original fix. Only Mirth Connect version 4.4.1 or later provides a complete remedy.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.