""ET EXPLOIT NextGen Mirth Connect <4.4.1 RCE Attempt (CVE-2023-43208)""

SID: 2053410

Revision: 1

Class Type: attempted-admin

Metadata: attack_target Server, tls_state TLSDecrypt, created_at 2024_06_10, cve CVE_2023_43208, deployment Perimeter, deployment SSLDecrypt, confidence Medium, signature_severity Major, tag Exploit, updated_at 2024_06_10

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: any

Destination Network: [$HOME_NET,$HTTP_SERVERS]

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

  • Value: "POST"

  • Value: "/api/users"

  • Value: "|20 20 3c|string|3e|" Depth: 10

  • Value: "|3c|iMethodName|3e|getMethod|3c 2f|iMethodName|3e|"

  • Value: "|3c|string|3e|getRuntime|3c 2f|string|3e|"

  • Value: "|3c|iMethodName|3e|invoke|3c 2f|iMethodName|3e 0d 0a|"

  • Value: "Content|3a 20|application/xml|0d 0a|"

Within:

PCRE:

Special Options:

  • http_method

  • http_uri

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_header

  • nocase

source