External risk intelligence

NextGen Mirth Connect RCE Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-37679

NextGen Mirth Connect is an integration engine typically used to facilitate data exchange between healthcare systems. It is commonly deployed as a network-accessible middleware service, often acting as a gateway or interface point for external systems to send and receive data, making it frequently reachable via network interfaces.

Nextgen Mirth Connect

4.3.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in NextGen Mirth Connect, an integration engine used in healthcare, allows for remote command execution on the hosting server. This means an attacker could potentially run unauthorized commands without needing any credentials. The main concern at this time is to confirm if this specific version is in use and therefore potentially exposed.

Attackers can run unauthorized commands remotely.
It impacts healthcare data integration systems.
Confirm if this specific version is deployed.

Attack Path

How an attacker could exploit the issue

A remote command execution vulnerability exists in NextGen Mirth Connect that could allow an attacker to run arbitrary commands on the server. This exposure could occur if an attacker can reach the Mirth Connect service over the network and trigger a specific condition within the software. If successful, this could lead to the attacker gaining control of the server.

Network access to the service is required.
Triggering a vulnerable function in Mirth Connect.
Arbitrary command execution on the server.

Live Threat

Current exploitation, exposure, and threat context

A remote command execution vulnerability in NextGen Mirth Connect could allow an unauthenticated attacker to run arbitrary commands on the server hosting the application. This could potentially impact the integrity and availability of the server and any connected systems.

Server command execution is at risk.
Exploitation occurs over the network.
Attacker can control the server.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world remediation likely involves the platform or infrastructure teams responsible for hosting Mirth Connect, in coordination with application owners who manage its integration workflows and potentially the vendor-management team if engaged with NextGen. The immediate priority is to identify all Mirth Connect deployments, assess their network exposure and criticality, and confirm the accountable owner for each instance before planning remediation.

Platform or application owners should lead.
Verify Mirth Connect instances and exposure.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is NextGen Mirth Connect?

NextGen Mirth Connect is an integration engine designed for healthcare environments. It acts as middleware to manage, translate, and route data exchanges between different clinical applications and hospital systems, often serving as a central hub for health information interoperability.

What does CWE-77 mean for CVE-2023-37679?

This vulnerability is classified as CWE-77, which refers to Improper Neutralization of Special Elements used in a Command. In simple terms, the software fails to properly sanitize user-supplied input before passing it to a system shell. Because of this flaw, CVE-2023-37679 allows an attacker to inject their own malicious commands, which the server then executes as if they were legitimate system instructions.

How is this Mirth Connect vulnerability triggered?

An attacker triggers this flaw by sending specifically crafted network requests to the Mirth Connect service. Because the vulnerability lies in how the application processes incoming data, it does not require the attacker to have existing login credentials. Simply interacting with the service over the network is enough, provided the application is in a state where it accepts the malformed input.

Is my Mirth Connect instance at risk?

According to Halo Surface Signal, Mirth Connect is typically deployed as a network-accessible service to facilitate data exchange, which often makes it reachable from outside environments. If your instance is internet-facing or accessible to unauthorized network segments, the risk is higher because the vulnerability is exploitable remotely without any user authentication.

How do I respond to this CVE?

Your first step is to perform an inventory of your environment to identify all running instances of Mirth Connect, specifically checking for version 4.3.0. Once identified, coordinate with the team managing the infrastructure to assess whether the service is reachable from the network. Prioritize confirming ownership of these instances so that you can implement vendor-provided updates or mitigation steps once they are verified.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.