CVE-2021-46578
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code by tricking users into opening malicious JT files in Bentley MicroStation CONNECT. Attackers can achieve code execution in the context of the current process, affecting all users of vulnerable versions who open untrusted JT files.
💻 Affected Systems
- Bentley MicroStation CONNECT
📦 What is this software?
View by Bentley
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through remote code execution leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Malicious code execution with user privileges, potentially leading to data exfiltration, credential theft, or installation of persistent malware.
If Mitigated
Limited impact through application sandboxing or restricted user privileges, though still potentially damaging to user data and local system.
🎯 Exploit Status
Exploitation requires user interaction but is straightforward once malicious JT file is opened. ZDI-CAN-15372 indicates professional vulnerability research.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.16.0.80 or later with security updates
Vendor Advisory: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
Restart Required: Yes
Instructions:
1. Download latest MicroStation CONNECT update from Bentley Systems 2. Install the update following vendor instructions 3. Restart the application and system if prompted
🔧 Temporary Workarounds
Disable JT file association
windowsRemove JT file type association with MicroStation to prevent automatic opening
Windows: Control Panel > Default Programs > Associate a file type or protocol with a program > Remove .jt association
Application sandboxing
allRun MicroStation in restricted environment or sandbox
🧯 If You Can't Patch
- Implement strict file validation policies to block untrusted JT files
- Use application whitelisting to prevent execution of unauthorized code
🔍 How to Verify
Check if Vulnerable:
Check MicroStation version: Help > About MicroStation CONNECTCheck Version:
In MicroStation: Help > About MicroStation CONNECTVerify Fix Applied:
Verify version is 10.16.0.80 or later with security updates applied📡 Detection & Monitoring
Log Indicators:
- Application crashes when parsing JT files
- Unusual process creation from MicroStation
- Failed file parsing attempts
Network Indicators:
- Downloads of JT files from untrusted sources
- External connections initiated by MicroStation process
SIEM Query:
Process Creation where ParentImage contains 'MicroStation' AND CommandLine contains '.jt'