Detect Sierra Wireless AirLink ALEOS Unrestricted File Upload Exploitation in IBM QRadar
Detects exploitation of CVE-2018-4063, an unrestricted file upload vulnerability (CWE-434) in Sierra Wireless AirLink ALEOS firmware. Attackers can upload files with dangerous types via the ACEmanager web interface, enabling remote code execution on cellular gateway devices. This vulnerability is listed in CISA KEV and has been exploited in the wild against critical infrastructure.
MITRE ATT&CK
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
sourceip AS source_ip,
destinationip AS destination_ip,
destinationport AS dest_port,
URL AS request_url,
"HTTP Method" AS http_method,
username,
QIDNAME(qid) AS event_name,
logsourcename(logSourceId) AS log_source
FROM events
WHERE
LOGSOURCETYPENAME(deviceType) IN ('Apache HTTP Server', 'Microsoft IIS', 'Juniper Networks Firewall', 'Palo Alto Networks Firewall')
AND destinationport IN (9443, 443, 80, 8080)
AND "HTTP Method" = 'POST'
AND (
URL IMATCHES '.*acemanager.*'
OR URL IMATCHES '.*/upload.*'
OR URL IMATCHES '.*/cgi-bin.*'
OR URL IMATCHES '.*/firmware.*'
)
AND (
URL IMATCHES '.*\.php$'
OR URL IMATCHES '.*\.asp$'
OR URL IMATCHES '.*\.aspx$'
OR URL IMATCHES '.*\.jsp$'
OR URL IMATCHES '.*\.cgi$'
OR URL IMATCHES '.*\.sh$'
OR URL IMATCHES '.*\.elf$'
OR URL IMATCHES '.*\.py$'
)
AND starttime > NOW() - 3600000
ORDER BY starttime DESC
LIMIT 500AQL query detecting HTTP POST requests to Sierra Wireless AirLink ALEOS management paths with dangerous file extensions, correlated across web server and firewall log sources.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate ACEmanager firmware upload sessions initiated by authorized network administrators
- Automated device provisioning pipelines pushing configuration files to ALEOS gateways
- Authorized security assessments probing ALEOS management interfaces for vulnerability verification
- Managed service provider remote management sessions involving ALEOS configuration file transfers
Other platforms for CVE-2018-4063
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate File Upload to ALEOS ACEmanager Endpoint
Expected signal: HTTP POST to port 9443 with multipart/form-data body containing a .php file extension; network flow from attacker IP to ALEOS management IP
- Test 2Upload ELF Binary to ALEOS CGI Directory
Expected signal: POST request to /cgi-bin/upload with Content-Disposition header containing filename ending in .elf; successful HTTP 200 response if device is unpatched
- Test 3Enumerate ALEOS ACEmanager Upload Endpoints
Expected signal: Sequential GET requests from a single source IP to multiple ALEOS management paths within a short time window; HTTP response codes indicating which paths are accessible
References (4)
- https://www.cisa.gov/news-events/ics-advisories/icsa-19-122-03
- https://source.sierrawireless.com/resources/airlink/software_reference_docs/technical-bulletin/sierra-wireless-technical-bulletin---swi-psa-2019-003
- https://source.sierrawireless.com/resources/airlink/hardware_reference_docs/airlink_es450_eol
- https://nvd.nist.gov/vuln/detail/CVE-2018-4063
Unlock Pro Content
Get the full detection package for CVE-2018-4063 including response playbook, investigation guide, and atomic red team tests.