CVE-2021-34937
📋 TL;DR
CVE-2021-34937 is a use-after-free vulnerability in Bentley View's JT file parser that allows remote code execution when users open malicious JT files. Attackers can exploit this to execute arbitrary code with the privileges of the current user. This affects users of Bentley View 10.15.0.75 who open untrusted JT files.
💻 Affected Systems
- Bentley View
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via arbitrary code execution with user privileges, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Malware installation or data exfiltration when users open malicious JT files from untrusted sources.
If Mitigated
Limited impact if proper application whitelisting and user training prevent execution of malicious files.
🎯 Exploit Status
Exploitation requires user interaction but is straightforward once malicious file is opened. ZDI has published advisory details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to Bentley View version 10.16.02 or later
Vendor Advisory: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
Restart Required: Yes
Instructions:
1. Download latest Bentley View from official Bentley website. 2. Install update. 3. Restart system. 4. Verify version is 10.16.02 or higher.
🔧 Temporary Workarounds
Disable JT file association
windowsRemove JT file type association with Bentley View to prevent automatic opening
Control Panel > Default Programs > Associate a file type or protocol with a program > Select .jt > Change program > Choose different application
Application control policy
windowsImplement application whitelisting to block execution of Bentley View from untrusted locations
🧯 If You Can't Patch
- Implement strict email filtering to block JT attachments
- Train users to never open JT files from untrusted sources
🔍 How to Verify
Check if Vulnerable:
Check Bentley View version: Open Bentley View > Help > About. If version is 10.15.0.75, system is vulnerable.Check Version:
Not applicable - check via GUI onlyVerify Fix Applied:
Verify Bentley View version is 10.16.02 or higher in Help > About dialog.📡 Detection & Monitoring
Log Indicators:
- Process creation events for Bentley View with suspicious parent processes
- File access events for JT files from unusual locations
Network Indicators:
- Outbound connections from Bentley View process to unknown IPs
- JT file downloads from untrusted sources
SIEM Query:
Process Creation where Image contains 'BentleyView.exe' AND ParentImage NOT IN ('explorer.exe', 'cmd.exe')