Detect Sierra Wireless AirLink ALEOS Unrestricted File Upload Exploitation in Splunk
Detects exploitation of CVE-2018-4063, an unrestricted file upload vulnerability (CWE-434) in Sierra Wireless AirLink ALEOS firmware. Attackers can upload files with dangerous types via the ACEmanager web interface, enabling remote code execution on cellular gateway devices. This vulnerability is listed in CISA KEV and has been exploited in the wild against critical infrastructure.
MITRE ATT&CK
SPL Detection Query
index=network OR index=syslog OR index=proxy
| eval time_window=relative_time(now(), "-1h")
| where _time >= time_window
(
[search sourcetype IN (cisco:asa, pan:traffic, paloalto:firewall)
dest_port IN (9443, 443, 80, 8080)
(url="*acemanager*" OR url="*/upload*" OR url="*/cgi-bin*" OR uri_path="*/firmware*")
http_method=POST]
OR
[search sourcetype=sierrawireless:aleos
(message="*upload*" OR message="*file*" OR message="*POST*")]
OR
[search sourcetype IN (access_combined, iis)
method=POST
(uri_path="*acemanager*" OR uri_path="*/upload*" OR uri_path="*/cgi-bin*")
(uri_path="*.php" OR uri_path="*.asp" OR uri_path="*.aspx" OR uri_path="*.jsp" OR uri_path="*.cgi" OR uri_path="*.sh" OR uri_path="*.elf")]
)
| eval dangerous_ext=if(match(uri_path, "\.(php|asp|aspx|jsp|cgi|sh|py|pl|exe|elf)$"), "true", "false")
| eval cve="CVE-2018-4063"
| eval vendor="Sierra Wireless"
| eval product="AirLink ALEOS"
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as source_ips values(uri_path) as upload_paths values(dangerous_ext) as file_types by dest_ip dest_port
| where count > 0
| sort -last_seenDetects POST requests targeting Sierra Wireless AirLink ALEOS ACEmanager upload endpoints with dangerous file extensions across network proxy, IIS, and device syslog sources.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Authorized firmware upgrades uploaded by network operations teams via ACEmanager web portal
- Legitimate configuration backups or restore operations involving file uploads to ALEOS devices
- Authorized penetration testing or vulnerability scanning activity targeting ALEOS management interfaces
- Automated monitoring scripts performing scheduled health-check uploads to cellular gateway devices
Other platforms for CVE-2018-4063
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate File Upload to ALEOS ACEmanager Endpoint
Expected signal: HTTP POST to port 9443 with multipart/form-data body containing a .php file extension; network flow from attacker IP to ALEOS management IP
- Test 2Upload ELF Binary to ALEOS CGI Directory
Expected signal: POST request to /cgi-bin/upload with Content-Disposition header containing filename ending in .elf; successful HTTP 200 response if device is unpatched
- Test 3Enumerate ALEOS ACEmanager Upload Endpoints
Expected signal: Sequential GET requests from a single source IP to multiple ALEOS management paths within a short time window; HTTP response codes indicating which paths are accessible
References (4)
- https://www.cisa.gov/news-events/ics-advisories/icsa-19-122-03
- https://source.sierrawireless.com/resources/airlink/software_reference_docs/technical-bulletin/sierra-wireless-technical-bulletin---swi-psa-2019-003
- https://source.sierrawireless.com/resources/airlink/hardware_reference_docs/airlink_es450_eol
- https://nvd.nist.gov/vuln/detail/CVE-2018-4063
Response Playbook
Triage
- Identify the source IP of the POST request and determine whether it belongs to a known authorized administrator IP range or NAT address used by the network operations team.
- Inspect the uploaded file extension and content type in proxy or web server logs — prioritize PHP, CGI, shell scripts, and ELF binaries as they indicate likely webshell or implant staging.
- Determine the specific ALEOS device targeted (by destination IP) and cross-reference against your asset inventory to assess criticality — prioritize devices in OT/ICS environments, remote sites, or those with access to internal networks.
- Check whether the upload resulted in a successful HTTP 200 response, which would indicate the file was accepted by the ALEOS ACEmanager interface.
Containment
- If exploitation is confirmed, immediately isolate the affected Sierra Wireless AirLink device by blocking its management port (default 9443/TCP) at the upstream firewall or network access control boundary.
- Revoke and rotate all credentials (ACEmanager admin password, VPN certificates, API keys) associated with the compromised ALEOS device to prevent lateral movement via established sessions.
- If the device provides cellular WAN connectivity to critical infrastructure, evaluate a controlled failover to a backup link before isolation to preserve availability during the incident response.
Evidence Collection
- Capture and preserve ACEmanager web server access logs from the ALEOS device, including the raw HTTP request containing the uploaded file name, content type header, and source IP.
- If physically accessible, obtain a firmware dump or system snapshot of the ALEOS device to identify any unauthorized files deposited in web-accessible directories or persistent storage.
- Collect NetFlow or PCAP data showing outbound connections from the ALEOS device in the 24 hours following the suspicious upload event to detect C2 callbacks or data exfiltration.
Escalation Criteria
- !Escalate immediately to the incident response team if the uploaded file has been accessed (subsequent GET request to the same path), indicating a deployed webshell or reverse shell has been triggered.
- !Escalate to OT/ICS security team and notify CISA if the compromised ALEOS device bridges IT and operational technology networks, given the ICS advisory context (ICSA-19-122-03) for this vulnerability.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
ACEmanager HTTP access log entries showing POST requests to /upload, /cgi-bin, or /firmware paths with non-standard file extensions - >
ALEOS device filesystem artifacts: unexpected files in web-accessible directories (/www, /cgi-bin) with executable permissions - >
Outbound network connections from the ALEOS device IP to non-Sierra-Wireless external IPs on uncommon ports following the upload event - >
Authentication logs showing repeated or anomalous ACEmanager login attempts immediately preceding the file upload
Tuning Guidance
Reduce false positives by building an allowlist of authorized ACEmanager administrator source IPs and scheduled maintenance windows. Restrict alerting to file extensions that are definitively executable on ALEOS firmware (ELF, CGI, SH) for higher-confidence alerts, and use the broader extension list (PHP, ASP, JSP) as a medium-confidence supplemental hunt. If Sierra Wireless devices are managed by a central NMS, exclude that NMS IP from triggering. Consider baselining normal firmware upgrade frequency per device and alerting on deviations.
Hunting Queries
Broad hunt across 7 days for any repeated upload or POST activity against Sierra Wireless ALEOS management interfaces, surfacing low-and-slow attack patterns that single-event rules may miss.
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DeviceVendor =~ "Sierra Wireless" or DeviceProduct =~ "ALEOS"
| where Activity has_any ('upload', 'POST', 'file', 'firmware')
| summarize count() by SourceIP, DestinationIP, Activity, bin(TimeGenerated, 1h)
| where count_ > 3
| order by TimeGenerated descindex=network sourcetype IN (sierrawireless:aleos, access_combined)
(message="*upload*" OR method=POST) (uri_path="*acemanager*" OR uri_path="*/cgi-bin*")
| stats count by src_ip, dest_ip, uri_path, _time
| where count > 1
| sort -_timeAtomic Red Team Tests
Simulates an attacker uploading a PHP webshell to the ACEmanager web interface of a Sierra Wireless AirLink device. Run only in an isolated lab with a test ALEOS unit.
Command
curl -k -X POST https://TARGET_ALEOS_IP:9443/upload -u admin:admin -F 'file=@/tmp/test_shell.php' -H 'Content-Type: multipart/form-data' -vCleanup
curl -k -X DELETE https://TARGET_ALEOS_IP:9443/upload/test_shell.php -u admin:adminExpected Telemetry
HTTP POST to port 9443 with multipart/form-data body containing a .php file extension; network flow from attacker IP to ALEOS management IP
Expected Detection
Alert triggers on POST request matching acemanager/upload path with .php extension in proxy logs or network telemetry
Simulates uploading a compiled ELF binary (reverse shell) to the ALEOS CGI directory, which would execute with device-level privileges if successful.
Command
# Create a benign ELF placeholder for lab testing
echo 'ELF_PLACEHOLDER' > /tmp/test_implant.elf
curl -k -X POST https://TARGET_ALEOS_IP:9443/cgi-bin/upload -u admin:admin -F 'firmware=@/tmp/test_implant.elf' -vCleanup
rm /tmp/test_implant.elfExpected Telemetry
POST request to /cgi-bin/upload with Content-Disposition header containing filename ending in .elf; successful HTTP 200 response if device is unpatched
Expected Detection
Alert triggers on POST to /cgi-bin path with .elf file extension in network monitoring or web proxy logs
Simulates attacker reconnaissance of Sierra Wireless ALEOS management interface to identify upload-capable endpoints before exploitation.
Command
# Discovery phase — enumerate known ALEOS management paths
for path in /acemanager /upload /cgi-bin /firmware /config /update; do
curl -k -o /dev/null -s -w "%{http_code} %{url_effective}\n" https://TARGET_ALEOS_IP:9443${path}
doneCleanup
# No cleanup needed — read-only enumerationExpected Telemetry
Sequential GET requests from a single source IP to multiple ALEOS management paths within a short time window; HTTP response codes indicating which paths are accessible
Expected Detection
Behavioral detection on rapid sequential requests to management paths from a non-whitelisted IP; triggers on scanning pattern in network logs