CVE-2021-34933
📋 TL;DR
CVE-2021-34933 is a use-after-free vulnerability in Bentley View's JT file parser that allows remote code execution. Attackers can exploit this by tricking users into opening malicious JT files or visiting malicious web pages. This affects users of Bentley View 10.15.0.75 who process JT files.
💻 Affected Systems
- Bentley View
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the current user, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Local privilege escalation leading to unauthorized access to sensitive files, system configuration changes, or installation of persistent malware.
If Mitigated
Limited impact with proper application sandboxing and user privilege restrictions, potentially resulting in application crash only.
🎯 Exploit Status
Exploitation requires user interaction but is straightforward once malicious content is delivered. ZDI has published technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to Bentley View version 10.16.02 or later
Vendor Advisory: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
Restart Required: Yes
Instructions:
1. Download latest Bentley View installer from official Bentley website
2. Run installer with administrative privileges
3. Restart system after installation completes
🔧 Temporary Workarounds
Disable JT file association
windowsRemove Bentley View as default handler for .jt files to prevent automatic exploitation
Control Panel > Default Programs > Associate a file type or protocol with a program > Select .jt > Change program > Choose different application
Application sandboxing
windowsRun Bentley View in restricted environment using application control solutions
🧯 If You Can't Patch
- Implement strict network segmentation to isolate systems running vulnerable Bentley View
- Deploy application whitelisting to prevent execution of unauthorized processes
🔍 How to Verify
Check if Vulnerable:
Check Bentley View version in Help > About dialog. If version is 10.15.0.75, system is vulnerable.Check Version:
Not applicable - check via GUI Help > About menuVerify Fix Applied:
Verify version is 10.16.02 or later in Help > About dialog after update.📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory access violations
- Unusual process creation from Bentley View executable
- Failed attempts to load corrupted JT files
Network Indicators:
- Downloads of JT files from untrusted sources
- Network traffic to known malicious domains following JT file processing
SIEM Query:
Process Creation where Image contains 'bentley' AND ParentImage contains 'explorer' AND CommandLine contains '.jt'