CVE-2021-46564
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code by tricking users into opening malicious JT files in Bentley MicroStation CONNECT. Attackers can exploit a buffer overflow in JT file parsing to gain code execution in the current process context. Users of affected Bentley MicroStation versions are at risk.
💻 Affected Systems
- Bentley MicroStation CONNECT
📦 What is this software?
View by Bentley
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via remote code execution, allowing attackers to install malware, steal data, or pivot to other systems.
Likely Case
Malware installation or data theft through user-initiated malicious file opening, potentially leading to ransomware or credential theft.
If Mitigated
Limited impact with proper user training and file restrictions, potentially only causing application crashes.
🎯 Exploit Status
Exploitation requires user interaction but no authentication. Weaponization likely due to ZDI publication and RCE nature.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.16.1.0 or later
Vendor Advisory: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
Restart Required: Yes
Instructions:
1. Download latest MicroStation CONNECT version from Bentley website
2. Run installer with administrative privileges
3. Restart system after installation completes
🔧 Temporary Workarounds
Disable JT file association
windowsRemove JT file type association with MicroStation to prevent automatic opening
Windows: Control Panel > Default Programs > Associate a file type or protocol with a program > Remove .jt association
Implement file extension filtering
allBlock JT files at email/web gateway or endpoint protection
🧯 If You Can't Patch
- Implement application whitelisting to block unauthorized executables
- Train users to avoid opening JT files from untrusted sources
🔍 How to Verify
Check if Vulnerable:
Check MicroStation version in Help > About. If version is 10.16.0.80 or earlier, system is vulnerable.Check Version:
Windows: wmic product where name="MicroStation" get versionVerify Fix Applied:
Verify version is 10.16.1.0 or later in Help > About. Test with known safe JT files to ensure parsing works.📡 Detection & Monitoring
Log Indicators:
- Application crashes with JT file parsing errors
- Unusual process creation from MicroStation executable
Network Indicators:
- Downloads of JT files from suspicious sources
- Outbound connections from MicroStation to unknown IPs
SIEM Query:
process_name:"ustation.exe" AND (event_id:1000 OR event_id:1001) AND file_extension:".jt"