CVE-2021-34931
📋 TL;DR
CVE-2021-34931 is a use-after-free vulnerability in Bentley View's JT file parser that allows remote code execution. Attackers can exploit this by tricking users into opening malicious JT files or visiting malicious web pages. This affects users of Bentley View 10.15.0.75 who process JT files.
💻 Affected Systems
- Bentley View
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining the same privileges as the Bentley View process, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Local privilege escalation or arbitrary code execution within the context of the Bentley View application, potentially leading to data exfiltration or further system compromise.
If Mitigated
Limited impact with proper application sandboxing and user privilege restrictions, potentially only application crash or denial of service.
🎯 Exploit Status
Exploitation requires user interaction but is straightforward once malicious JT file is opened. ZDI-CAN-14909 tracking suggests active research interest.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to Bentley View version 10.16.02 or later
Vendor Advisory: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
Restart Required: Yes
Instructions:
1. Download latest Bentley View installer from official Bentley website. 2. Run installer with administrative privileges. 3. Follow installation prompts. 4. Restart system after installation completes.
🔧 Temporary Workarounds
Disable JT file association
windowsRemove Bentley View as default handler for .jt files to prevent automatic exploitation
Control Panel > Default Programs > Associate a file type or protocol with a program > Select .jt > Change program > Choose different application
Application sandboxing
windowsRun Bentley View with reduced privileges using application sandboxing tools
🧯 If You Can't Patch
- Implement strict network segmentation to isolate systems running vulnerable Bentley View
- Deploy application control policies to block execution of untrusted JT files
🔍 How to Verify
Check if Vulnerable:
Check Bentley View version in Help > About. If version is 10.15.0.75, system is vulnerable.Check Version:
Not applicable - check via GUI in Help > About menuVerify Fix Applied:
Verify Bentley View version is 10.16.02 or later in Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Unexpected Bentley View crashes when processing JT files
- Suspicious child processes spawned from Bentley View
Network Indicators:
- Outbound connections from Bentley View to unexpected destinations
- JT file downloads from untrusted sources
SIEM Query:
Process Creation where Parent Process Name contains 'BentleyView.exe' AND Command Line contains suspicious patterns