CVE-2021-46572
📋 TL;DR
This is a buffer overflow vulnerability in Bentley MicroStation CONNECT that allows remote code execution when users open malicious JT files. Attackers can exploit this to run arbitrary code with the privileges of the current user. Affects users of Bentley MicroStation CONNECT who open untrusted JT files.
💻 Affected Systems
- Bentley MicroStation CONNECT
📦 What is this software?
View by Bentley
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via arbitrary code execution with user privileges, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Malware installation or data exfiltration when users open malicious JT files from untrusted sources.
If Mitigated
Limited impact if users only open trusted files and proper endpoint protection is in place.
🎯 Exploit Status
Exploitation requires user interaction but is technically straightforward once a malicious JT file is crafted.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.16.0.80 or later patched versions
Vendor Advisory: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
Restart Required: Yes
Instructions:
1. Download the latest version from Bentley's official website or update service. 2. Run the installer with administrative privileges. 3. Restart the system after installation completes.
🔧 Temporary Workarounds
Disable JT file association
windowsRemove JT file type association with MicroStation to prevent automatic opening
Control Panel > Default Programs > Associate a file type or protocol with a program > Select .jt > Change program > Choose another application
Block JT files at perimeter
allConfigure email and web gateways to block JT file attachments
🧯 If You Can't Patch
- Implement application whitelisting to prevent execution of unauthorized code
- Restrict user privileges to limit potential damage from successful exploitation
🔍 How to Verify
Check if Vulnerable:
Check MicroStation version via Help > About. If version is 10.16.0.80 or earlier, system is vulnerable.Check Version:
In MicroStation: Help > About MicroStationVerify Fix Applied:
Verify version is updated to 10.16.0.80 or later via Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Process crashes of MicroStation.exe
- Unusual child processes spawned from MicroStation
- Failed attempts to open corrupted JT files
Network Indicators:
- Downloads of JT files from untrusted sources
- Outbound connections from MicroStation to unknown IPs
SIEM Query:
Process Creation where Image contains 'MicroStation' and CommandLine contains '.jt'