CVE-2021-34939
📋 TL;DR
CVE-2021-34939 is a use-after-free vulnerability in Bentley View's JT file parser that allows remote code execution when a user opens a malicious JT file or visits a malicious webpage. Attackers can exploit this to execute arbitrary code with the privileges of the current user. This affects users of Bentley View 10.15.0.75 who process untrusted JT files.
💻 Affected Systems
- Bentley View
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via arbitrary code execution with user privileges, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Malware installation or data exfiltration when users open malicious JT files from untrusted sources.
If Mitigated
Limited impact if users only open trusted files and application runs with minimal privileges.
🎯 Exploit Status
Exploitation requires user interaction but is straightforward once malicious file is opened. ZDI published advisory with technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to Bentley View version 10.16.02.01 or later
Vendor Advisory: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
Restart Required: Yes
Instructions:
1. Download latest Bentley View from official Bentley website. 2. Run installer. 3. Restart system after installation completes.
🔧 Temporary Workarounds
Disable JT file association
windowsRemove Bentley View as default handler for .jt files to prevent automatic exploitation
Windows: Control Panel > Default Programs > Associate a file type or protocol with a program > Select .jt > Change program > Choose different application
Application sandboxing
allRun Bentley View in restricted environment with limited privileges
🧯 If You Can't Patch
- Implement strict file validation policies to block untrusted JT files at email gateways and web proxies
- Run Bentley View with minimal user privileges and enable application control/whitelisting
🔍 How to Verify
Check if Vulnerable:
Check Bentley View version in Help > About. If version is 10.15.0.75, system is vulnerable.Check Version:
Windows: Check program version in Control Panel > Programs and Features. Linux: Check package version via package manager.Verify Fix Applied:
Verify version is 10.16.02.01 or later in Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Process crashes of Bentley View with memory access violations
- Unexpected child processes spawned from Bentley View
Network Indicators:
- Outbound connections from Bentley View to suspicious IPs
- DNS requests for known malicious domains after file opening
SIEM Query:
Process creation where parent_process contains 'BentleyView.exe' AND (process_name contains 'cmd.exe' OR process_name contains 'powershell.exe' OR process_name contains 'wscript.exe')