pentestfreemedium

Interpreter (Mirth Connect → f-string Injection)

hackthebox

Task: HackTheBox machine with Mirth Connect 4.4.0 healthcare integration engine. Solution: CVE-2023-43208 XStream deserialization for initial RCE as mirth user, then privilege escalation via Python f-string double eval injection in internal Flask service running as root, using chr() encoding to bypass regex filter.

$ ls tags/ techniques/
flaskrcedeserializationinternal_servicepython_evalchr_encodingprivescmirth_connectcve-2023-43208xstreamfstring_injectionhl7healthcareregex_bypass
xstream_deserialization_rcefstring_double_evalchr_bypass_regexbase64_command_exfiltrationwget_post_file_exfilinternal_service_abusexml_injection_to_eval

$ cat /etc/rate-limit

Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.

Interpreter (Mirth Connect → f-string Injection) — HackTheBox

Description

Full machine on HackTheBox. Mirth Connect 4.4.0 (healthcare integration engine) with CVE-2023-43208 vulnerability for initial access, then privilege escalation via Python f-string injection in an internal Flask service running as root.

  • Target: 10.129.7.17
  • OS: Debian 12, kernel 6.1.0-43-amd64
  • Stack: Jetty (Mirth Connect 4.4.0), Flask/Werkzeug 2.2.2, MariaDB 10.5
  • Users: root, sedric (uid=1000), mirth (uid=103)

Flags

#TypeFlagMethod
1Userb63665586c7eca1656d9f9b6b821e48af-string injection → open('/home/sedric/user.txt').read()
2Root9acc749ecf629eb2fa239153b8e2cacdf-string injection → open('/root/root.txt').read()

Reconnaissance

Nmap Scan

nmap -sV -sC -T4 -p- --min-rate=1000 10.129.7.17

Open ports:

  • 22 — SSH (OpenSSH 9.2p1 Debian)
  • 53 — DNS
  • 80/443 — HTTP/HTTPS (Jetty — Mirth Connect Administrator 4.4.0)
  • 6661 — Mirth TCP/HL7 Listener (MLLP protocol)

Internal services (discovered after initial access):

  • 127.0.0.1:54321 — Flask/Werkzeug 2.2.2 (notif.py, runs as root)
  • 127.0.0.1:3306 — MariaDB (credentials: mirthdb:MirthPass123!)

Identification

  • HTTP title: "Mirth Connect Administrator"
  • SSL cert CN: mirth-connect
  • Mirth Connect — open-source healthcare integration engine for routing HL7 messages
  • Version 4.4.0 is vulnerable to CVE-2023-43208 (pre-auth RCE)

Step 1: Initial Access — CVE-2023-43208 (XStream Deserialization RCE)

Mirth Connect 4.4.0 has a critical vulnerability CVE-2023-43208 — unauthenticated RCE via XStream deserialization in /api/users POST endpoint.

Vulnerability

  • Endpoint /api/users accepts XML without authentication
  • XStream parser deserializes arbitrary Java objects
  • Gadget chain: ChainedTransformer + InvokerTransformer + EventUtils$EventBindingInvocationHandler
  • Result: Runtime.getRuntime().exec(command) as user mirth

Exploit (rce.py)

#!/usr/bin/env python3
"""CVE-2023-43208 RCE helper - executes commands and exfiltrates output"""

import requests
import urllib3
import sys
import time
import threading
import base64 as b64
from http.server import HTTPServer, BaseHTTPRequestHandler

urllib3.disable_warnings()

...

$ grep --similar

Similar writeups