Sierra Wireless AirLink ALEOS Unrestricted File Upload Exploitation

let SierraWirelessPorts = dynamic([9443, 443, 80, 8080]);
let DangerousExtensions = dynamic(['.php', '.asp', '.aspx', '.jsp', '.cgi', '.sh', '.py', '.pl', '.exe', '.elf']);
let timeWindow = 1h;
union
(
    DeviceNetworkEvents
    | where TimeGenerated > ago(timeWindow)
    | where RemotePort in (SierraWirelessPorts)
    | where InitiatingProcessCommandLine has_any ('curl', 'wget', 'python', 'upload')
    | where RemoteUrl has_any ('acemanager', '/upload', '/cgi-bin', '/firmware')
    | project TimeGenerated, DeviceName, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessCommandLine, ActionType
),
(
    CommonSecurityLog
    | where TimeGenerated > ago(timeWindow)
    | where DeviceVendor =~ "Sierra Wireless" or DeviceProduct =~ "ALEOS"
    | where Activity has_any ('upload', 'POST', 'file')
    | project TimeGenerated, DeviceAddress, SourceIP, DestinationIP, Activity, AdditionalExtensions
),
(
    W3CIISLog
    | where TimeGenerated > ago(timeWindow)
    | where csMethod == "POST"
    | where csUriStem has_any ('/acemanager', '/upload', '/cgi-bin')
    | extend FileExt = extract(@'(\.[a-zA-Z0-9]+)$', 1, csUriQuery)
    | where FileExt in (DangerousExtensions)
    | project TimeGenerated, cIP, csUriStem, csUriQuery, FileExt, scStatus
)
| extend AlertSeverity = "High"
| extend CVE = "CVE-2018-4063"
| order by TimeGenerated desc

index=network OR index=syslog OR index=proxy
| eval time_window=relative_time(now(), "-1h")
| where _time >= time_window
(
  [search sourcetype IN (cisco:asa, pan:traffic, paloalto:firewall)
   dest_port IN (9443, 443, 80, 8080)
   (url="*acemanager*" OR url="*/upload*" OR url="*/cgi-bin*" OR uri_path="*/firmware*")
   http_method=POST]
OR
  [search sourcetype=sierrawireless:aleos
   (message="*upload*" OR message="*file*" OR message="*POST*")]
OR
  [search sourcetype IN (access_combined, iis)
   method=POST
   (uri_path="*acemanager*" OR uri_path="*/upload*" OR uri_path="*/cgi-bin*")
   (uri_path="*.php" OR uri_path="*.asp" OR uri_path="*.aspx" OR uri_path="*.jsp" OR uri_path="*.cgi" OR uri_path="*.sh" OR uri_path="*.elf")]
)
| eval dangerous_ext=if(match(uri_path, "\.(php|asp|aspx|jsp|cgi|sh|py|pl|exe|elf)$"), "true", "false")
| eval cve="CVE-2018-4063"
| eval vendor="Sierra Wireless"
| eval product="AirLink ALEOS"
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as source_ips values(uri_path) as upload_paths values(dangerous_ext) as file_types by dest_ip dest_port
| where count > 0
| sort -last_seen

sequence by source.ip with maxspan=5m
  [network where destination.port in (9443, 443, 80, 8080)
   and http.request.method == "POST"
   and (
     url.path like "*acemanager*" or
     url.path like "*/upload*" or
     url.path like "*/cgi-bin*" or
     url.path like "*/firmware*"
   )
  ]
  [network where destination.port in (9443, 443, 80, 8080)
   and (
     url.path like "*.php" or
     url.path like "*.asp" or
     url.path like "*.aspx" or
     url.path like "*.jsp" or
     url.path like "*.cgi" or
     url.path like "*.sh" or
     url.path like "*.elf" or
     url.path like "*.py"
   )
  ]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip AS source_ip,
  destinationip AS destination_ip,
  destinationport AS dest_port,
  URL AS request_url,
  "HTTP Method" AS http_method,
  username,
  QIDNAME(qid) AS event_name,
  logsourcename(logSourceId) AS log_source
FROM events
WHERE
  LOGSOURCETYPENAME(deviceType) IN ('Apache HTTP Server', 'Microsoft IIS', 'Juniper Networks Firewall', 'Palo Alto Networks Firewall')
  AND destinationport IN (9443, 443, 80, 8080)
  AND "HTTP Method" = 'POST'
  AND (
    URL IMATCHES '.*acemanager.*'
    OR URL IMATCHES '.*/upload.*'
    OR URL IMATCHES '.*/cgi-bin.*'
    OR URL IMATCHES '.*/firmware.*'
  )
  AND (
    URL IMATCHES '.*\.php$'
    OR URL IMATCHES '.*\.asp$'
    OR URL IMATCHES '.*\.aspx$'
    OR URL IMATCHES '.*\.jsp$'
    OR URL IMATCHES '.*\.cgi$'
    OR URL IMATCHES '.*\.sh$'
    OR URL IMATCHES '.*\.elf$'
    OR URL IMATCHES '.*\.py$'
  )
  AND starttime > NOW() - 3600000
ORDER BY starttime DESC
LIMIT 500

_sourceCategory=network/proxy OR _sourceCategory=network/firewall OR _sourceCategory=web/access
| parse "method=*" as http_method nodrop
| parse "url=*" as request_url nodrop
| parse "src_ip=*" as source_ip nodrop
| parse "dest_ip=*" as dest_ip nodrop
| parse "dest_port=*" as dest_port nodrop
| where dest_port in ("9443", "443", "80", "8080")
| where http_method = "POST"
| where request_url matches "*acemanager*"
  OR request_url matches "*/upload*"
  OR request_url matches "*/cgi-bin*"
  OR request_url matches "*/firmware*"
| where request_url matches "*.php"
  OR request_url matches "*.asp"
  OR request_url matches "*.aspx"
  OR request_url matches "*.jsp"
  OR request_url matches "*.cgi"
  OR request_url matches "*.sh"
  OR request_url matches "*.elf"
  OR request_url matches "*.py"
| withtime _messageTime
| count by source_ip, dest_ip, dest_port, request_url
| sort by _count desc
| fields source_ip, dest_ip, dest_port, request_url, _count

rule cve_2018_4063_aleos_unrestricted_upload {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2018-4063: Sierra Wireless AirLink ALEOS unrestricted file upload exploitation via ACEmanager"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://www.cisa.gov/news-events/ics-advisories/icsa-19-122-03"
    cve = "CVE-2018-4063"
    mitre_attack = "T1190, T1059"

  events:
    $http.metadata.event_type = "NETWORK_HTTP"
    $http.network.http.method = "POST"
    (
      $http.network.http.request_url = /acemanager/i
      or $http.network.http.request_url = /\/upload/i
      or $http.network.http.request_url = /\/cgi-bin/i
      or $http.network.http.request_url = /\/firmware/i
    )
    (
      $http.network.http.request_url = /\.php$/i
      or $http.network.http.request_url = /\.asp$/i
      or $http.network.http.request_url = /\.aspx$/i
      or $http.network.http.request_url = /\.jsp$/i
      or $http.network.http.request_url = /\.cgi$/i
      or $http.network.http.request_url = /\.sh$/i
      or $http.network.http.request_url = /\.elf$/i
      or $http.network.http.request_url = /\.py$/i
    )
    $http.network.application_protocol = "HTTP" or $http.network.application_protocol = "HTTPS"
    $http.principal.ip = $source_ip
    $http.target.ip = $dest_ip

  condition:
    $http
}

#event_simpleName=NetworkConnectIP4 OR #event_simpleName=NetworkConnectIP6 OR #event_simpleName=HttpRequest
| RemotePort in (9443, 443, 80, 8080)
| HttpMethod = "POST"
| UrlPath = /acemanager|^\/upload|\/cgi-bin|\/firmware/i
| UrlPath = /\.(php|asp|aspx|jsp|cgi|sh|elf|py)$/i
| groupBy([RemoteAddressIP4, RemotePort, UrlPath, HttpMethod, aid, ComputerName], function=([count(aid, as=upload_attempts), min(timestamp, as=first_seen), max(timestamp, as=last_seen)]))
| eval cve = "CVE-2018-4063"
| eval product = "Sierra Wireless AirLink ALEOS"
| eval tactic = "Initial Access"
| sort(last_seen, order=desc)