CVE-2021-46621
📋 TL;DR
This is a double-free vulnerability in Bentley MicroStation CONNECT's JT file parser that allows remote code execution. Attackers can exploit it by tricking users into opening malicious JT files or visiting malicious web pages. Affects users of Bentley MicroStation CONNECT 10.16.0.80 who process untrusted JT files.
💻 Affected Systems
- Bentley MicroStation CONNECT
📦 What is this software?
View by Bentley
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker executing arbitrary code in the context of the current user, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Remote code execution leading to malware installation, data exfiltration, or system disruption for users who open malicious JT files.
If Mitigated
Limited impact with proper application sandboxing and user privilege restrictions, potentially only application crash or denial of service.
🎯 Exploit Status
Exploitation requires user interaction but has been weaponized by ZDI. Attackers need to craft malicious JT files or web content.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to version 10.16.02.34 or later
Vendor Advisory: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
Restart Required: Yes
Instructions:
1. Download latest MicroStation CONNECT update from Bentley's official site. 2. Run installer with administrative privileges. 3. Restart system after installation completes.
🔧 Temporary Workarounds
Restrict JT file processing
allBlock or restrict processing of JT files from untrusted sources
Application sandboxing
windowsRun MicroStation in restricted/sandboxed environment
🧯 If You Can't Patch
- Implement application whitelisting to prevent execution of unauthorized code
- Restrict user privileges to limit potential damage from successful exploitation
🔍 How to Verify
Check if Vulnerable:
Check MicroStation version via Help > About. If version is 10.16.0.80, system is vulnerable.Check Version:
Not applicable - check via application GUI Help > AboutVerify Fix Applied:
Verify version is 10.16.02.34 or later in Help > About dialog.📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing JT files
- Unusual process creation from MicroStation
Network Indicators:
- Downloads of JT files from suspicious sources
- Outbound connections after JT file processing
SIEM Query:
Process creation where parent_process contains 'ustation.exe' AND (process contains 'cmd.exe' OR process contains 'powershell.exe')