CVE-2021-34899
📋 TL;DR
CVE-2021-34899 is a buffer overflow vulnerability in Bentley View's JT file parser that allows remote code execution. Attackers can exploit it by tricking users into opening malicious JT files, potentially compromising affected systems. This affects users of Bentley View 10.15.0.75 who open untrusted JT files.
💻 Affected Systems
- Bentley View
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the victim's machine, data theft, and lateral movement within the network.
Likely Case
Malware installation, data exfiltration, or ransomware deployment on individual workstations where users open malicious JT files.
If Mitigated
Limited to denial of service or application crash if exploit fails or security controls block execution.
🎯 Exploit Status
Exploitation requires user interaction but is technically straightforward once malicious JT file is crafted. ZDI published advisory with technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to Bentley View version 10.16.0.80 or later
Vendor Advisory: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
Restart Required: Yes
Instructions:
1. Download latest Bentley View installer from Bentley website. 2. Run installer with administrative privileges. 3. Follow installation wizard. 4. Restart system after installation completes.
🔧 Temporary Workarounds
Disable JT file association
windowsRemove Bentley View as default handler for .jt files to prevent automatic opening
Control Panel > Default Programs > Associate a file type or protocol with a program > Select .jt > Change program > Choose different application
Block JT files at perimeter
allConfigure email/web gateways to block .jt file attachments and downloads
🧯 If You Can't Patch
- Implement application whitelisting to prevent unauthorized code execution
- Restrict user privileges to standard user accounts (not administrator)
🔍 How to Verify
Check if Vulnerable:
Check Bentley View version: Open Bentley View > Help > About. If version is 10.15.0.75, system is vulnerable.Check Version:
Not applicable - check via GUI in Help > About menuVerify Fix Applied:
Verify version is 10.16.0.80 or later in Help > About dialog.📡 Detection & Monitoring
Log Indicators:
- Application crashes of Bentley View
- Unusual process creation from Bentley View
- Failed attempts to open corrupted JT files
Network Indicators:
- Downloads of JT files from untrusted sources
- Outbound connections from Bentley View to suspicious IPs
SIEM Query:
Process Creation where Image contains 'BentleyView.exe' and CommandLine contains '.jt'