CVE-2021-34921
📋 TL;DR
CVE-2021-34921 is a buffer overflow vulnerability in Bentley View's JT file parser that allows remote code execution. Attackers can exploit this by tricking users into opening malicious JT files, potentially compromising their systems. This affects users of Bentley View 10.15.0.75 who open untrusted JT files.
💻 Affected Systems
- Bentley View
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the victim's machine, data theft, and lateral movement within the network.
Likely Case
Malware installation, data exfiltration, or ransomware deployment on individual workstations running Bentley View.
If Mitigated
Limited impact with proper network segmentation, application sandboxing, and user awareness preventing malicious file execution.
🎯 Exploit Status
User interaction required (opening malicious file). Exploit likely exists in the wild given the nature of the vulnerability and ZDI disclosure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to Bentley View version 10.16.02 or later
Vendor Advisory: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
Restart Required: Yes
Instructions:
1. Download latest Bentley View from official Bentley website. 2. Run installer. 3. Restart system after installation completes.
🔧 Temporary Workarounds
Disable JT file association
windowsRemove Bentley View as default handler for .jt files to prevent automatic opening
Control Panel > Default Programs > Associate a file type or protocol with a program > Select .jt > Change program > Choose another application
Application sandboxing
windowsRun Bentley View in restricted environment to limit impact of exploitation
🧯 If You Can't Patch
- Implement strict email filtering to block JT attachments
- Use application whitelisting to prevent unauthorized code execution
🔍 How to Verify
Check if Vulnerable:
Check Bentley View version in Help > About. If version is 10.15.0.75, system is vulnerable.Check Version:
Not applicable - check via GUI in Help > AboutVerify Fix Applied:
Verify version is 10.16.02 or later in Help > About.📡 Detection & Monitoring
Log Indicators:
- Process crashes of Bentley View
- Unusual child processes spawned from Bentley View
- Failed attempts to open corrupted JT files
Network Indicators:
- Outbound connections from Bentley View to unknown IPs
- Unusual data exfiltration patterns
SIEM Query:
Process: BentleyView.exe AND (EventID: 1000 OR ParentProcess: BentleyView.exe)