CVE-2021-46638
📋 TL;DR
This is a stack-based buffer overflow vulnerability in Bentley MicroStation CONNECT that allows remote code execution. Attackers can exploit it by tricking users into opening malicious DGN files, potentially taking full control of the affected system. Users of Bentley MicroStation CONNECT version 10.16.0.80 are affected.
💻 Affected Systems
- Bentley MicroStation CONNECT
📦 What is this software?
View by Bentley
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the workstation, enabling data theft, lateral movement, and persistent access.
Likely Case
Local privilege escalation leading to installation of malware, ransomware, or backdoors on the affected system.
If Mitigated
Limited impact with proper application sandboxing and file validation, potentially only causing application crashes.
🎯 Exploit Status
Exploitation requires user interaction but the vulnerability is well-documented and part of ZDI's disclosure program.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.16.0.80 Update 1 or later
Vendor Advisory: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0009
Restart Required: Yes
Instructions:
1. Download the latest update from Bentley's official website or update service. 2. Run the installer with administrative privileges. 3. Restart the system after installation completes.
🔧 Temporary Workarounds
Restrict DGN file handling
windowsConfigure system to open DGN files only with trusted applications or in sandboxed environments.
Use Windows Group Policy to restrict file associations for .dgn files
User awareness training
allEducate users to only open DGN files from trusted sources and verify file integrity.
🧯 If You Can't Patch
- Implement application whitelisting to prevent execution of unauthorized code
- Use endpoint detection and response (EDR) solutions to monitor for suspicious file parsing behavior
🔍 How to Verify
Check if Vulnerable:
Check MicroStation version via Help > About menu or verify installed version in Windows Programs and Features.Check Version:
In MicroStation: Help > About, or on Windows: wmic product where name="MicroStation" get versionVerify Fix Applied:
Verify version is 10.16.0.80 Update 1 or later and test with known safe DGN files to ensure proper parsing.📡 Detection & Monitoring
Log Indicators:
- Application crashes when opening DGN files
- Unusual process spawning from MicroStation.exe
Network Indicators:
- Downloads of DGN files from untrusted sources
- Outbound connections from MicroStation to suspicious IPs
SIEM Query:
Process Creation where Image contains "MicroStation" and ParentImage contains "explorer.exe" and CommandLine contains ".dgn"