CVE-2021-46588
📋 TL;DR
This is a use-after-free vulnerability in Bentley MicroStation CONNECT that allows remote code execution when parsing malicious JT files. Attackers can exploit it by tricking users into opening specially crafted files, potentially compromising systems running the vulnerable software.
💻 Affected Systems
- Bentley MicroStation CONNECT
📦 What is this software?
View by Bentley
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the current user, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Local privilege escalation or arbitrary code execution within the context of the MicroStation process, potentially allowing file system access and further exploitation.
If Mitigated
Limited impact with proper application sandboxing and user privilege restrictions, potentially only crashing the application.
🎯 Exploit Status
Exploitation requires user interaction but no authentication. The vulnerability is well-documented and was assigned ZDI-CAN-15382.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 10.16.0.80
Vendor Advisory: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
Restart Required: Yes
Instructions:
1. Download and install the latest MicroStation CONNECT update from Bentley's official website. 2. Restart the application and any related services. 3. Verify the update was successful by checking the version number.
🔧 Temporary Workarounds
Restrict JT file handling
windowsConfigure system to open JT files with alternative applications or block JT file execution in MicroStation
Use Windows Group Policy to modify file associations for .jt files
Implement application control policies to restrict MicroStation from opening untrusted JT files
User awareness training
allEducate users about the risks of opening untrusted engineering files
🧯 If You Can't Patch
- Implement application sandboxing or virtualization for MicroStation
- Restrict user privileges to limit potential damage from successful exploitation
🔍 How to Verify
Check if Vulnerable:
Check MicroStation version: Open MicroStation, go to Help > About, verify version is 10.16.0.80 or earlier.Check Version:
On Windows: Check application properties or registry at HKEY_LOCAL_MACHINE\SOFTWARE\Bentley\MicroStationVerify Fix Applied:
After updating, verify version is newer than 10.16.0.80 in Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing JT files
- Unexpected process creation from MicroStation
- Memory access violations in application logs
Network Indicators:
- Downloads of JT files from untrusted sources
- Unusual outbound connections from MicroStation process
SIEM Query:
Process Creation where Image contains 'ustation' AND CommandLine contains '.jt'