CVE-2021-34913
📋 TL;DR
CVE-2021-34913 is a buffer overflow vulnerability in Bentley View's JT file parser that allows remote code execution. Attackers can exploit it by tricking users into opening malicious JT files, potentially compromising affected systems. Users of vulnerable Bentley View versions are at risk.
💻 Affected Systems
- Bentley View
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control over the affected system, data theft, and lateral movement within the network.
Likely Case
Local privilege escalation leading to data exfiltration, installation of malware, or ransomware deployment on the affected workstation.
If Mitigated
Limited impact with proper network segmentation and application sandboxing, potentially only crashing the Bentley View application.
🎯 Exploit Status
Exploitation requires user interaction but is straightforward once malicious JT file is opened. ZDI has confirmed the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Bentley View 10.16.0.80 or later
Vendor Advisory: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
Restart Required: Yes
Instructions:
1. Download latest Bentley View from official Bentley website. 2. Run installer. 3. Restart system after installation completes.
🔧 Temporary Workarounds
Disable JT file association
windowsRemove Bentley View as default handler for JT files to prevent automatic exploitation
Control Panel > Default Programs > Associate a file type or protocol with a program > Select .jt > Change program > Choose different application
Application sandboxing
allRun Bentley View in restricted environment to limit potential damage
🧯 If You Can't Patch
- Implement strict email filtering for JT file attachments
- Block JT file downloads from untrusted sources via web proxy
🔍 How to Verify
Check if Vulnerable:
Check Bentley View version in Help > About dialog. If version is 10.15.0.75 or earlier, system is vulnerable.Check Version:
Not applicable - check via GUI Help > About menuVerify Fix Applied:
Verify version is 10.16.0.80 or later in Help > About dialog.📡 Detection & Monitoring
Log Indicators:
- Application crashes when opening JT files
- Unusual process creation from Bentley View executable
Network Indicators:
- Unexpected outbound connections from Bentley View process
- JT file downloads from suspicious sources
SIEM Query:
Process Creation where Image contains 'bentley' AND ParentImage contains 'explorer' AND CommandLine contains '.jt'