CVE-2021-46590
📋 TL;DR
This is a buffer overflow vulnerability in Bentley MicroStation CONNECT that allows remote code execution when users open malicious JT files. Attackers can exploit this to run arbitrary code with the privileges of the current user. All users of affected MicroStation versions are vulnerable.
💻 Affected Systems
- Bentley MicroStation CONNECT
📦 What is this software?
View by Bentley
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Malware installation, data exfiltration, or system disruption when users open malicious JT files.
If Mitigated
Limited impact if proper network segmentation, least privilege, and file validation are implemented.
🎯 Exploit Status
Requires user interaction to open malicious JT file. Exploit development is feasible given the buffer overflow nature.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.16.0.80 or later patched versions
Vendor Advisory: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
Restart Required: Yes
Instructions:
1. Download latest MicroStation CONNECT update from Bentley's official site. 2. Run installer with administrative privileges. 3. Restart system after installation completes.
🔧 Temporary Workarounds
Block JT file extensions
allPrevent opening of JT files at the email gateway or endpoint.
Application whitelisting
windowsRestrict execution of MicroStation to trusted directories only.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate MicroStation systems
- Enforce least privilege principles and disable unnecessary user permissions
🔍 How to Verify
Check if Vulnerable:
Check MicroStation version via Help > About. If version is 10.16.0.80 or earlier, system is vulnerable.Check Version:
In MicroStation: Help > About or check Windows Programs and FeaturesVerify Fix Applied:
Verify version is updated beyond 10.16.0.80 and test opening known safe JT files.📡 Detection & Monitoring
Log Indicators:
- Application crashes of MicroStation
- Unusual process creation from MicroStation
Network Indicators:
- Unexpected outbound connections from MicroStation process
SIEM Query:
Process creation where parent process contains 'MicroStation' AND (command line contains '.jt' OR image loaded from suspicious location)