CVE-2021-46568
📋 TL;DR
This is a buffer overflow vulnerability in Bentley MicroStation CONNECT that allows remote code execution. Attackers can exploit it by tricking users into opening malicious JT files, potentially taking control of the affected system. Users of vulnerable Bentley MicroStation CONNECT installations are affected.
💻 Affected Systems
- Bentley MicroStation CONNECT
📦 What is this software?
View by Bentley
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control over the workstation, potentially leading to lateral movement within the network, data theft, or ransomware deployment.
Likely Case
Local privilege escalation leading to installation of malware, data exfiltration, or persistence mechanisms on the compromised workstation.
If Mitigated
Limited impact due to application sandboxing or restricted user privileges, potentially resulting in application crash rather than full compromise.
🎯 Exploit Status
Exploitation requires user interaction but the vulnerability itself is straightforward - crafted JT file triggers buffer overflow. ZDI advisory suggests reliable exploitation is possible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 10.16.1.0 or later
Vendor Advisory: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
Restart Required: Yes
Instructions:
1. Download latest MicroStation CONNECT update from Bentley's official website or through Bentley CONNECTION Client. 2. Run the installer with administrative privileges. 3. Restart the system after installation completes.
🔧 Temporary Workarounds
Disable JT file association
windowsRemove JT file type association with MicroStation to prevent automatic opening
Control Panel > Default Programs > Associate a file type or protocol with a program > Select .jt > Change program > Choose another application
Implement application whitelisting
allRestrict execution of MicroStation to trusted locations only
🧯 If You Can't Patch
- Implement strict email filtering to block JT attachments
- Use application sandboxing or virtualization for MicroStation execution
🔍 How to Verify
Check if Vulnerable:
Check MicroStation version: Open MicroStation > Help > About > Check if version is 10.16.0.80 or earlierCheck Version:
On Windows: wmic product where name="MicroStation" get versionVerify Fix Applied:
Verify version is 10.16.1.0 or later in Help > About dialog📡 Detection & Monitoring
Log Indicators:
- Application crashes with access violation errors
- Unexpected child processes spawned from MicroStation
- Unusual file access patterns from MicroStation process
Network Indicators:
- Outbound connections from MicroStation to unknown IPs
- DNS queries for suspicious domains from workstation running MicroStation
SIEM Query:
Process Creation where Image contains "MicroStation" and CommandLine contains ".jt"