--- analysis: A static rule might alert on a version string, but this hunt pivots between inventory, API traffic prevalence, and the behavioral aftermath of exploitation (unusual file writes from the service process) to distinguish active compromise from simple presence of the software. blind_spots: - id: incomplete-http-visibility question: What specific SQL or XML payloads were sent to the /api/ endpoints? requires: full HTTP POST body logging risk: The hunt can identify rare traffic but cannot see the exploit payload itself to confirm malicious intent before a file is written. stage: exploit-web-activity - id: generic-java-process question: Is the java.exe process definitively the Mirth Connect service? requires: accurate process_cmd_line context risk: In environments with many Java-based services, file writes from java.exe may be noisy; command-line inspection is required to maintain fidelity. stage: post-exploit-impact coverage: - stage: vulnerability-exposure-identification status: covered steps: - mirth-inventory - stage: authenticated-api-access status: covered steps: - rare-api-source-ips - blind_spot: incomplete-http-visibility reason: HTTP surfaces do not typically capture the POST bodies required to see SQL injection or XXE payloads. stage: exploit-web-activity status: not_visible - stage: post-exploit-impact status: covered steps: - mirth-file-writes guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: promote-to-detection justification: Mirth Connect is critical infrastructure for healthcare data interchange; the identified vulnerabilities allow authenticated users to move from management API access to arbitrary code execution through file writes. methodology: model-assisted trigger: intel-report hypothesis: An intruder is exploiting SQL injection or XXE vulnerabilities in NextGen Mirth Connect to exfiltrate credentials or write malicious files from the service process, typically identifiable by rare API traffic and unusual file system activity. labels: - hunt - attack.t1190 - attack.t1041 - attack.t1133 - attack.t1566 name: NextGen Mirth Connect Exploitation and Exfiltration parameters: lookback_days: default: '14' description: Days of history to examine. from: kind: manual observed: '2026-09-10' ref: hunt-standard type: number mirth_processes: default: - mirth.exe - mcserver.exe - java.exe - java description: Candidate process names for the Mirth Connect service. from: kind: manual observed: '2026-09-10' ref: product-documentation type: list[string] scope_hosts: default: [] description: Specific hostnames found in the scoping step; leave empty to hunt across the entire estate. from: kind: manual observed: '2026-09-10' ref: analyst-defined type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-253-01 gates: - dry-run - lint model: hb_google/gemini-3-flash-preview rationale: Start by identifying all servers running Mirth Connect; narrow to those with Internet exposure via hb_exposed_assets if the estate is large. references: - name: CISA Advisory (ICSMA-26-253-01) url: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-253-01 related: - hunt: mirth-connect-pre-auth-rce-v4-4 reason: Previous CVEs such as CVE-2023-43208 involved pre-authentication RCE which uses different management API paths. relation: out-of-scope-alternative scenario: stages: - name: Identification of Vulnerable Mirth Connect Instances observables: - Mirth Connect version <= 4.7.1 - Mirth Connect service exposure - CVE-2026-82583 - CVE-2026-78224 - CVE-2026-82578 slug: vulnerability-exposure-identification tactic: initial-access techniques: - T1190 - name: Authenticated Access to Database Connector API observables: - Authentication to Database Connector API - Logins to Mirth Connect management interface slug: authenticated-api-access tactic: initial-access techniques: - T1133 - name: SQL Injection and XXE Exploitation Traffic observables: - Database Connector API requests containing SQL syntax - XSLT Transformer Step configuration changes - XML batch processing with XPath enabled - HTTP POST requests with DOCTYPE or ENTITY tags - Requests to /api/ (Mirth Connect API) slug: exploit-web-activity tactic: execution techniques: - T1190 - name: Arbitrary File Write and Data Exfiltration observables: - Mirth Connect process (java.exe/mirth.exe) writing files to unexpected paths - Outbound network connections from Mirth Connect server to external IPs - DNS queries for out-of-band XXE exfiltration - Extraction of stored credentials from connected systems slug: post-exploit-impact tactic: exfiltration techniques: - T1041 summary: Attackers exploit SQL injection and XML External Entity (XXE) vulnerabilities in NextGen Healthcare Mirth Connect (v4.7.1 and earlier) to gain unauthorized access and exfiltrate data. Successful exploitation allows authenticated users to execute arbitrary SQL via the Database Connector API or trigger XXE flaws in XSLT and XML batch processing steps, leading to credential theft, arbitrary file writes, and data exfiltration. severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent web: category: siem name: Web server / proxy logs telemetry: - network tlp: clear type: investigation --- # NextGen Mirth Connect Exploitation and Exfiltration NextGen Mirth Connect versions 4.7.1 and earlier are vulnerable to critical flaws including SQL injection (CVE-2026-82583) and XXE (CVE-2026-78224, CVE-2026-82578). These allow authenticated users to move from API access to full system compromise. This hunt identifies vulnerable instances, baselines the source IPs hitting management APIs, and searches for the behavioral aftermath of exploitation where the Mirth service process writes executable files or scripts to the host. ## mirth-inventory Find hosts running Mirth Connect versions 4.7.1 or earlier to define the hunt scope. ```sqlite target=endpoint role=scoping ~~~yaml expected: A list of hosts and versions. Silence suggests no vulnerable versions are currently installed. reads: - device_hostname - package_name - package_version - install_path silence: not_evidence_of_absence source: hb_software_inventory verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, package_name, package_version, install_path FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%mirth%connect%' OR LOWER(package_name) LIKE '%nextgen%connect%') AND (package_version LIKE '4.7.1%' OR package_version LIKE '4.7.0%' OR package_version LIKE '4.6%' OR package_version LIKE '4.5%' OR package_version LIKE '4.4%' OR package_version LIKE '4.3%' OR package_version LIKE '4.2%' OR package_version LIKE '4.1%' OR package_version LIKE '4.0%' OR package_version LIKE '3.%' OR package_version LIKE '2.%' OR package_version LIKE '1.%') ``` ## rare-api-source-ips Identify uncommon source IPs accessing Mirth management endpoints, which may indicate unauthorized authenticated access. ```sqlite target=web role=baseline params=(scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: Source IPs that only target a single host. Normal administrative traffic usually originates from a consistent set of management subnets. prevalence: by: device_hostname key: - src_endpoint_ip rare_below: 3 reads: - src_endpoint_ip - device_hostname - url_path - time silence: not_evidence_of_absence source: hb_http_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT src_endpoint_ip, COUNT(DISTINCT device_hostname) AS host_count, COUNT(*) AS request_count, MIN(time) AS first_seen FROM hb_http_activity WHERE (url_path LIKE '/api/channels%' OR url_path LIKE '/api/database%' OR url_path LIKE '/api/users%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY src_endpoint_ip HAVING host_count <= 2 ORDER BY host_count ASC, request_count DESC ``` ## mirth-file-writes Search for the Mirth service process writing executable files or scripts, a high-confidence indicator of successful SQL injection exploitation. ```sqlite target=endpoint role=detection-candidate params=(mirth_processes=mirth_processes, scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml expected: The Mirth service writing new script or binary files. This process should rarely drop new executables outside of maintenance windows. reads: - device_hostname - process_name - process_cmd_line - file_path - activity_name - time silence: evidence_of_absence source: hb_file_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, process_name, process_cmd_line, file_path, activity_name, time FROM hb_file_activity WHERE (instr(',' || '{{mirth_processes}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR process_cmd_line LIKE '%com.mirth.connect.server.Mirth%') AND activity_id IN (1, 3, 5) AND (LOWER(file_path) LIKE '%.exe' OR LOWER(file_path) LIKE '%.jsp' OR LOWER(file_path) LIKE '%.ps1' OR LOWER(file_path) LIKE '%.bat' OR LOWER(file_path) LIKE '%.sh' OR LOWER(file_path) LIKE '%\webapps\%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## analyze-exposure ```agent target=hunter cite: required context: - mirth-inventory - rare-api-source-ips - mirth-file-writes max_iterations: 3 objective: Determine if any host running Mirth Connect v4.7.1 or earlier shows signs of active exploitation, focusing on the overlap between rare source IPs and suspicious file writes. success_criteria: A verdict of malicious, suspicious, or benign for each identified Mirth host. tools: - endpoint - web ``` ## route-findings if~: "the agent finds malicious or suspicious activity such as file writes or anomalous API access" (confidence: medium, judge=hunter) then: → remediation-review indeterminate: → remediation-review unavailable: → remediation-review (blind_spot: incomplete-http-visibility) else: → close-out ## remediation-review ```manual target=analyst Collect and analyze any files identified in the behavioural step. Confirm all Mirth Connect instances are upgraded to v4.7.2 or later to mitigate the vulnerabilities. ``` → close-out ## close-out ```manual target=analyst Document the number of vulnerable versus patched hosts. Record any findings of unauthorized access to the Database Connector API for future tuning. ``` → end