AI analysis
NextGen Connect (Mirth Connect) versions 4.7.1 and earlier contain a SQL injection flaw (CWE-89) in the Database Connector API. An attacker needs valid credentials but no elevated privileges or user interaction: an authenticated user can send crafted input to the connector API to execute arbitrary SQL against the underlying database. Successful exploitation can disclose credentials stored in Mirth Connect for connected downstream systems, write arbitrary files on the host (which could enable further compromise), and cause a denial-of-service condition. Any organization running NextGen Connect 4.7.1 or earlier — most commonly hospitals and health systems using it as an HL7/healthcare integration engine — is affected. As of now the flaw is not in the CISA KEV, no public proof-of-concept is known, and there are no reports of in-the-wild exploitation.
What to do: Upgrade NextGen Connect to a release later than 4.7.1 per NextGen Healthcare's security advisory. Until patched, restrict which authenticated accounts can reach the Database Connector API, ensure the connector's database account has least-privilege rights (limiting file-write and credential access), and avoid exposing the API to the internet. Review logs for unexpected SQL or file-write activity from user accounts, and rotate credentials stored in Mirth Connect for connected systems if compromise is suspected.
Affected
| NextGen Healthcare NextGen Connect (Mirth Connect) | 4.7.1 and earlier |
Estimated exposure
moderate≈10,000 deployments (public scans show several thousand internet-exposed Mirth Connect instances; most healthcare integrations run internal) — Estimate based on public internet scans that typically surface several thousand exposed Mirth Connect instances and its wide adoption in hospital interface-engine deployments, the majority of which are internal and thus not directly…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
NextGen Connect (Mirth Connect) versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector API, which could result in disclosure of stored credentials for connected systems, arbitrary file write, and a denial-of-service condition.