Detect Sierra Wireless AirLink ALEOS Unrestricted File Upload Exploitation in Sumo Logic CSE
Detects exploitation of CVE-2018-4063, an unrestricted file upload vulnerability (CWE-434) in Sierra Wireless AirLink ALEOS firmware. Attackers can upload files with dangerous types via the ACEmanager web interface, enabling remote code execution on cellular gateway devices. This vulnerability is listed in CISA KEV and has been exploited in the wild against critical infrastructure.
MITRE ATT&CK
Sumo Detection Query
_sourceCategory=network/proxy OR _sourceCategory=network/firewall OR _sourceCategory=web/access
| parse "method=*" as http_method nodrop
| parse "url=*" as request_url nodrop
| parse "src_ip=*" as source_ip nodrop
| parse "dest_ip=*" as dest_ip nodrop
| parse "dest_port=*" as dest_port nodrop
| where dest_port in ("9443", "443", "80", "8080")
| where http_method = "POST"
| where request_url matches "*acemanager*"
OR request_url matches "*/upload*"
OR request_url matches "*/cgi-bin*"
OR request_url matches "*/firmware*"
| where request_url matches "*.php"
OR request_url matches "*.asp"
OR request_url matches "*.aspx"
OR request_url matches "*.jsp"
OR request_url matches "*.cgi"
OR request_url matches "*.sh"
OR request_url matches "*.elf"
OR request_url matches "*.py"
| withtime _messageTime
| count by source_ip, dest_ip, dest_port, request_url
| sort by _count desc
| fields source_ip, dest_ip, dest_port, request_url, _countSumo Logic query identifying POST requests with dangerous file extensions targeting Sierra Wireless AirLink ALEOS ACEmanager upload endpoints across proxy, firewall, and web access log sources.
Data Sources
Required Tables
False Positives & Tuning
- Authorized ALEOS firmware update processes conducted by network operations teams
- Legitimate configuration management scripts uploading files to cellular gateways
- IT automation frameworks performing scheduled ALEOS device provisioning tasks
- Security team members conducting authorized vulnerability verification on test ALEOS units
Other platforms for CVE-2018-4063
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate File Upload to ALEOS ACEmanager Endpoint
Expected signal: HTTP POST to port 9443 with multipart/form-data body containing a .php file extension; network flow from attacker IP to ALEOS management IP
- Test 2Upload ELF Binary to ALEOS CGI Directory
Expected signal: POST request to /cgi-bin/upload with Content-Disposition header containing filename ending in .elf; successful HTTP 200 response if device is unpatched
- Test 3Enumerate ALEOS ACEmanager Upload Endpoints
Expected signal: Sequential GET requests from a single source IP to multiple ALEOS management paths within a short time window; HTTP response codes indicating which paths are accessible
References (4)
- https://www.cisa.gov/news-events/ics-advisories/icsa-19-122-03
- https://source.sierrawireless.com/resources/airlink/software_reference_docs/technical-bulletin/sierra-wireless-technical-bulletin---swi-psa-2019-003
- https://source.sierrawireless.com/resources/airlink/hardware_reference_docs/airlink_es450_eol
- https://nvd.nist.gov/vuln/detail/CVE-2018-4063
Unlock Pro Content
Get the full detection package for CVE-2018-4063 including response playbook, investigation guide, and atomic red team tests.