CVE-2021-34891
📋 TL;DR
CVE-2021-34891 is a use-after-free vulnerability in Bentley View's JT file parser that allows remote code execution when a user opens a malicious JT file or visits a malicious webpage. Attackers can exploit this to execute arbitrary code with the privileges of the current user. Users of Bentley View 10.15.0.75 are affected.
💻 Affected Systems
- Bentley View
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through arbitrary code execution leading to data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Malware installation, data exfiltration, or lateral movement within the network using the compromised user's privileges.
If Mitigated
Limited impact with proper application sandboxing, user privilege restrictions, and network segmentation preventing lateral movement.
🎯 Exploit Status
Exploitation requires user interaction but is straightforward once malicious file is opened. ZDI-CAN-14844 suggests exploit development occurred.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to Bentley View version 10.16.02.58 or later
Vendor Advisory: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
Restart Required: Yes
Instructions:
1. Download latest Bentley View installer from Bentley website. 2. Run installer with administrative privileges. 3. Restart system after installation completes.
🔧 Temporary Workarounds
Disable JT file association
windowsRemove JT file type association with Bentley View to prevent automatic opening
Control Panel > Default Programs > Associate a file type or protocol with a program > Select .jt > Change program > Choose different application
Application sandboxing
windowsRun Bentley View in restricted environment using application control solutions
🧯 If You Can't Patch
- Implement strict email filtering to block JT attachments
- Deploy application whitelisting to prevent unauthorized code execution
🔍 How to Verify
Check if Vulnerable:
Check Bentley View version in Help > About. If version is 10.15.0.75, system is vulnerable.Check Version:
Open Bentley View > Click Help menu > Select AboutVerify Fix Applied:
Verify version is 10.16.02.58 or later in Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Unexpected process creation from Bentley View executable
- JT file parsing errors in application logs
- Memory access violation events
Network Indicators:
- Outbound connections from Bentley View to unknown IPs
- Unusual network traffic patterns following JT file opening
SIEM Query:
Process Creation where Image contains 'BentleyView.exe' and CommandLine contains '.jt'