CVE-2021-46582
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code by tricking users into opening malicious JP2 image files in Bentley MicroStation CONNECT. Attackers can gain code execution in the context of the current process. Users of affected Bentley MicroStation versions are at risk.
💻 Affected Systems
- Bentley MicroStation CONNECT
📦 What is this software?
View by Bentley
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through remote code execution, potentially leading to data theft, ransomware deployment, or lateral movement within networks.
Likely Case
Local privilege escalation or malware installation on individual workstations when users open malicious JP2 files from untrusted sources.
If Mitigated
No impact if proper patching and security controls prevent execution of malicious files.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file) but the vulnerability itself is unauthenticated. Was reported through ZDI-CAN-15376.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to version 10.16.1.0 or later
Vendor Advisory: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0008
Restart Required: Yes
Instructions:
1. Download latest MicroStation CONNECT update from Bentley's official website. 2. Run the installer with administrative privileges. 3. Restart the application and any related services.
🔧 Temporary Workarounds
Disable JP2 file association
windowsRemove JP2 file type association with MicroStation to prevent automatic opening
Windows: Control Panel > Default Programs > Associate a file type or protocol with a program > Remove .jp2 association
Application whitelisting
allRestrict execution of MicroStation to trusted directories only
🧯 If You Can't Patch
- Implement strict email filtering to block JP2 attachments
- Educate users to never open JP2 files from untrusted sources
🔍 How to Verify
Check if Vulnerable:
Check MicroStation version: Open MicroStation > Help > About > Version numberCheck Version:
Windows: wmic product where name="MicroStation" get versionVerify Fix Applied:
Verify version is 10.16.1.0 or higher in About dialog📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing JP2 files
- Unexpected process creation from MicroStation
Network Indicators:
- Downloads of JP2 files from untrusted sources
- Outbound connections from MicroStation to unknown IPs
SIEM Query:
Process Creation where Image contains "MicroStation" AND ParentImage contains "explorer.exe"