NextGen Mirth Connect Exploitation and Exfiltration

Source

---
analysis: A static rule might alert on a version string, but this hunt pivots between
  inventory, API traffic prevalence, and the behavioral aftermath of exploitation
  (unusual file writes from the service process) to distinguish active compromise
  from simple presence of the software.
blind_spots:
- id: incomplete-http-visibility
  question: What specific SQL or XML payloads were sent to the /api/ endpoints?
  requires: full HTTP POST body logging
  risk: The hunt can identify rare traffic but cannot see the exploit payload itself
    to confirm malicious intent before a file is written.
  stage: exploit-web-activity
- id: generic-java-process
  question: Is the java.exe process definitively the Mirth Connect service?
  requires: accurate process_cmd_line context
  risk: In environments with many Java-based services, file writes from java.exe may
    be noisy; command-line inspection is required to maintain fidelity.
  stage: post-exploit-impact
coverage:
- stage: vulnerability-exposure-identification
  status: covered
  steps:
  - mirth-inventory
- stage: authenticated-api-access
  status: covered
  steps:
  - rare-api-source-ips
- blind_spot: incomplete-http-visibility
  reason: HTTP surfaces do not typically capture the POST bodies required to see SQL
    injection or XXE payloads.
  stage: exploit-web-activity
  status: not_visible
- stage: post-exploit-impact
  status: covered
  steps:
  - mirth-file-writes
guardrails:
  claims: no_unsupported
  evidence: citation_required
  missing_data: not_benign
  telemetry: untrusted
hunt:
  applicability: campaign-specific
  handoff: promote-to-detection
  justification: Mirth Connect is critical infrastructure for healthcare data interchange;
    the identified vulnerabilities allow authenticated users to move from management
    API access to arbitrary code execution through file writes.
  methodology: model-assisted
  trigger: intel-report
hypothesis: An intruder is exploiting SQL injection or XXE vulnerabilities in NextGen
  Mirth Connect to exfiltrate credentials or write malicious files from the service
  process, typically identifiable by rare API traffic and unusual file system activity.
labels:
- hunt
- attack.t1190
- attack.t1041
- attack.t1133
- attack.t1566
name: NextGen Mirth Connect Exploitation and Exfiltration
parameters:
  lookback_days:
    default: '14'
    description: Days of history to examine.
    from:
      kind: manual
      observed: '2026-09-10'
      ref: hunt-standard
    type: number
  mirth_processes:
    default:
    - mirth.exe
    - mcserver.exe
    - java.exe
    - java
    description: Candidate process names for the Mirth Connect service.
    from:
      kind: manual
      observed: '2026-09-10'
      ref: product-documentation
    type: list[string]
  scope_hosts:
    default: []
    description: Specific hostnames found in the scoping step; leave empty to hunt
      across the entire estate.
    from:
      kind: manual
      observed: '2026-09-10'
      ref: analyst-defined
    type: list[host]
provenance:
  authors:
  - name: Huntbase hunt generation
    org: huntbase.io
  generated:
    by: huntbase-hunt-generation
    from: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-253-01
    gates:
    - dry-run
    - lint
    model: hb_google/gemini-3-flash-preview
rationale: Start by identifying all servers running Mirth Connect; narrow to those
  with Internet exposure via hb_exposed_assets if the estate is large.
references:
- name: CISA Advisory (ICSMA-26-253-01)
  url: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-253-01
related:
- hunt: mirth-connect-pre-auth-rce-v4-4
  reason: Previous CVEs such as CVE-2023-43208 involved pre-authentication RCE which
    uses different management API paths.
  relation: out-of-scope-alternative
scenario:
  stages:
  - name: Identification of Vulnerable Mirth Connect Instances
    observables:
    - Mirth Connect version <= 4.7.1
    - Mirth Connect service exposure
    - CVE-2026-82583
    - CVE-2026-78224
    - CVE-2026-82578
    slug: vulnerability-exposure-identification
    tactic: initial-access
    techniques:
    - T1190
  - name: Authenticated Access to Database Connector API
    observables:
    - Authentication to Database Connector API
    - Logins to Mirth Connect management interface
    slug: authenticated-api-access
    tactic: initial-access
    techniques:
    - T1133
  - name: SQL Injection and XXE Exploitation Traffic
    observables:
    - Database Connector API requests containing SQL syntax
    - XSLT Transformer Step configuration changes
    - XML batch processing with XPath enabled
    - HTTP POST requests with DOCTYPE or ENTITY tags
    - Requests to /api/ (Mirth Connect API)
    slug: exploit-web-activity
    tactic: execution
    techniques:
    - T1190
  - name: Arbitrary File Write and Data Exfiltration
    observables:
    - Mirth Connect process (java.exe/mirth.exe) writing files to unexpected paths
    - Outbound network connections from Mirth Connect server to external IPs
    - DNS queries for out-of-band XXE exfiltration
    - Extraction of stored credentials from connected systems
    slug: post-exploit-impact
    tactic: exfiltration
    techniques:
    - T1041
  summary: Attackers exploit SQL injection and XML External Entity (XXE) vulnerabilities
    in NextGen Healthcare Mirth Connect (v4.7.1 and earlier) to gain unauthorized
    access and exfiltrate data. Successful exploitation allows authenticated users
    to execute arbitrary SQL via the Database Connector API or trigger XXE flaws in
    XSLT and XML batch processing steps, leading to credential theft, arbitrary file
    writes, and data exfiltration.
severity: high
targets:
  analyst:
    name: Tier-2 analyst
    role: analyst
  endpoint:
    category: endpoint
    name: Endpoint telemetry (hb_ surfaces)
    telemetry:
    - endpoint
  hunter:
    agent: true
    name: Hunt agent
  web:
    category: siem
    name: Web server / proxy logs
    telemetry:
    - network
tlp: clear
type: investigation
---


# NextGen Mirth Connect Exploitation and Exfiltration

NextGen Mirth Connect versions 4.7.1 and earlier are vulnerable to critical flaws including SQL injection (CVE-2026-82583) and XXE (CVE-2026-78224, CVE-2026-82578). These allow authenticated users to move from API access to full system compromise. This hunt identifies vulnerable instances, baselines the source IPs hitting management APIs, and searches for the behavioral aftermath of exploitation where the Mirth service process writes executable files or scripts to the host.

## mirth-inventory
<!-- Locate vulnerable Mirth Connect instances -->
Find hosts running Mirth Connect versions 4.7.1 or earlier to define the hunt scope.

```sqlite target=endpoint role=scoping
~~~yaml
expected: A list of hosts and versions. Silence suggests no vulnerable versions are
  currently installed.
reads:
- device_hostname
- package_name
- package_version
- install_path
silence: not_evidence_of_absence
source: hb_software_inventory
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT device_hostname, package_name, package_version, install_path FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%mirth%connect%' OR LOWER(package_name) LIKE '%nextgen%connect%') AND (package_version LIKE '4.7.1%' OR package_version LIKE '4.7.0%' OR package_version LIKE '4.6%' OR package_version LIKE '4.5%' OR package_version LIKE '4.4%' OR package_version LIKE '4.3%' OR package_version LIKE '4.2%' OR package_version LIKE '4.1%' OR package_version LIKE '4.0%' OR package_version LIKE '3.%' OR package_version LIKE '2.%' OR package_version LIKE '1.%')
```

## rare-api-source-ips
<!-- Baseline Mirth management API traffic -->
Identify uncommon source IPs accessing Mirth management endpoints, which may indicate unauthorized authenticated access.

```sqlite target=web role=baseline params=(scope_hosts=scope_hosts, lookback_days=lookback_days)
~~~yaml
baseline:
  compare: first_seen
  window: '{{lookback_days}}d'
expected: Source IPs that only target a single host. Normal administrative traffic
  usually originates from a consistent set of management subnets.
prevalence:
  by: device_hostname
  key:
  - src_endpoint_ip
  rare_below: 3
reads:
- src_endpoint_ip
- device_hostname
- url_path
- time
silence: not_evidence_of_absence
source: hb_http_activity
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT src_endpoint_ip, COUNT(DISTINCT device_hostname) AS host_count, COUNT(*) AS request_count, MIN(time) AS first_seen FROM hb_http_activity WHERE (url_path LIKE '/api/channels%' OR url_path LIKE '/api/database%' OR url_path LIKE '/api/users%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY src_endpoint_ip HAVING host_count <= 2 ORDER BY host_count ASC, request_count DESC
```

## mirth-file-writes
<!-- Find Mirth process file drops -->
Search for the Mirth service process writing executable files or scripts, a high-confidence indicator of successful SQL injection exploitation.

```sqlite target=endpoint role=detection-candidate params=(mirth_processes=mirth_processes, scope_hosts=scope_hosts, lookback_days=lookback_days)
~~~yaml
expected: The Mirth service writing new script or binary files. This process should
  rarely drop new executables outside of maintenance windows.
reads:
- device_hostname
- process_name
- process_cmd_line
- file_path
- activity_name
- time
silence: evidence_of_absence
source: hb_file_activity
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT device_hostname, process_name, process_cmd_line, file_path, activity_name, time FROM hb_file_activity WHERE (instr(',' || '{{mirth_processes}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR process_cmd_line LIKE '%com.mirth.connect.server.Mirth%') AND activity_id IN (1, 3, 5) AND (LOWER(file_path) LIKE '%.exe' OR LOWER(file_path) LIKE '%.jsp' OR LOWER(file_path) LIKE '%.ps1' OR LOWER(file_path) LIKE '%.bat' OR LOWER(file_path) LIKE '%.sh' OR LOWER(file_path) LIKE '%\webapps\%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')
```

## analyze-exposure
<!-- Evaluate exploitation evidence -->
```agent target=hunter
cite: required
context:
- mirth-inventory
- rare-api-source-ips
- mirth-file-writes
max_iterations: 3
objective: Determine if any host running Mirth Connect v4.7.1 or earlier shows signs
  of active exploitation, focusing on the overlap between rare source IPs and suspicious
  file writes.
success_criteria: A verdict of malicious, suspicious, or benign for each identified
  Mirth host.
tools:
- endpoint
- web
```

## route-findings
<!-- Route based on verdict -->
if~: "the agent finds malicious or suspicious activity such as file writes or anomalous API access" (confidence: medium, judge=hunter)
then: → remediation-review
indeterminate: → remediation-review
unavailable: → remediation-review (blind_spot: incomplete-http-visibility)
else: → close-out

## remediation-review
<!-- Forensic review and remediation -->
```manual target=analyst
Collect and analyze any files identified in the behavioural step. Confirm all Mirth Connect instances are upgraded to v4.7.2 or later to mitigate the vulnerabilities.
```
→ close-out

## close-out
<!-- Hunt close-out -->
```manual target=analyst
Document the number of vulnerable versus patched hosts. Record any findings of unauthorized access to the Database Connector API for future tuning.
```
→ end