CVE-2021-34872
📋 TL;DR
CVE-2021-34872 is a use-after-free vulnerability in Bentley View that allows remote code execution when users open malicious SKP files. Attackers can exploit this to execute arbitrary code with the privileges of the current user. Users of Bentley View 10.15.0.75 who open untrusted SKP files are affected.
💻 Affected Systems
- Bentley View
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via arbitrary code execution with user privileges, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Malware installation or data exfiltration when users open malicious SKP files from untrusted sources.
If Mitigated
No impact if users only open trusted SKP files or if the application is patched.
🎯 Exploit Status
Exploitation requires user interaction but is straightforward once malicious SKP file is opened. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to Bentley View version 10.16.02 or later
Vendor Advisory: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0014
Restart Required: Yes
Instructions:
1. Download latest Bentley View installer from Bentley website. 2. Run installer. 3. Restart computer after installation completes.
🔧 Temporary Workarounds
Disable SKP file association
windowsRemove Bentley View as default handler for .skp files to prevent automatic opening
Control Panel > Default Programs > Associate a file type or protocol with a program > Select .skp > Change program > Choose another application
Block SKP files at perimeter
allConfigure email/web gateways to block .skp file attachments
🧯 If You Can't Patch
- Implement application whitelisting to prevent execution of unauthorized code
- Educate users to never open SKP files from untrusted sources
🔍 How to Verify
Check if Vulnerable:
Check Bentley View version: Open Bentley View > Help > About Bentley ViewCheck Version:
Not applicable - check via GUI onlyVerify Fix Applied:
Verify version is 10.16.02 or higher in About dialog📡 Detection & Monitoring
Log Indicators:
- Process creation from Bentley View with unusual command lines
- Bentley View crashes when opening SKP files
Network Indicators:
- Outbound connections from Bentley View to unusual IPs/domains
SIEM Query:
Process Creation where Image contains 'Bentley View' and CommandLine contains unusual patterns