CVE-2021-46625
📋 TL;DR
CVE-2021-46625 is a double-free vulnerability in Bentley View's JT file parser that allows remote code execution when a user opens a malicious JT file or visits a malicious webpage. Attackers can exploit this to execute arbitrary code with the privileges of the current user. This affects users of Bentley View 10.15.0.75 who open untrusted JT files.
💻 Affected Systems
- Bentley View
📦 What is this software?
View by Bentley
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via remote code execution leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Malware installation or data exfiltration when users open malicious JT files from untrusted sources.
If Mitigated
Limited impact with proper application sandboxing and user privilege restrictions, potentially only application crash.
🎯 Exploit Status
Exploitation requires user interaction to open malicious file. The vulnerability was discovered by Zero Day Initiative (ZDI-CAN-15455).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to Bentley View version 10.16.02 or later
Vendor Advisory: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
Restart Required: Yes
Instructions:
1. Download latest Bentley View installer from official Bentley website. 2. Run installer as administrator. 3. Follow installation prompts. 4. Restart system after installation completes.
🔧 Temporary Workarounds
Disable JT file association
windowsRemove Bentley View as default handler for .jt files to prevent automatic exploitation
Control Panel > Default Programs > Associate a file type or protocol with a program > Select .jt > Change program > Choose different application
Application sandboxing
windowsRun Bentley View in restricted environment using application control solutions
🧯 If You Can't Patch
- Implement strict file type filtering on email gateways and web proxies to block .jt files
- Educate users to never open JT files from untrusted sources and implement least privilege principles
🔍 How to Verify
Check if Vulnerable:
Check Bentley View version in Help > About. If version is 10.15.0.75, system is vulnerable.Check Version:
In Bentley View: Help > About, or check registry: HKEY_LOCAL_MACHINE\SOFTWARE\Bentley\Bentley View\VersionVerify Fix Applied:
Verify version is 10.16.02 or later in Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Application crashes in Bentley View with access violation errors
- Unexpected process creation from Bentley View executable
Network Indicators:
- Downloads of .jt files from suspicious sources
- Outbound connections from Bentley View to unknown IPs
SIEM Query:
Process Creation where Image contains 'BentleyView.exe' AND ParentImage contains 'explorer.exe' AND CommandLine contains '.jt'