CVE-2021-46640
📋 TL;DR
This is a buffer overflow vulnerability in Bentley View's DGN file parser that allows remote code execution. Attackers can exploit it by tricking users into opening malicious DGN files or visiting malicious web pages. Users of affected Bentley View versions are at risk.
💻 Affected Systems
- Bentley View
📦 What is this software?
View by Bentley
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the victim's machine and potentially pivoting to other systems.
Likely Case
Attacker executes arbitrary code in the context of the current user, potentially stealing data, installing malware, or establishing persistence.
If Mitigated
Limited impact if file execution is blocked or application runs with minimal privileges.
🎯 Exploit Status
Exploitation requires user interaction but is straightforward once malicious file is opened.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to Bentley View version 10.16.02.03 or later
Vendor Advisory: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0009
Restart Required: Yes
Instructions:
1. Download latest Bentley View installer from official Bentley website. 2. Run installer with administrative privileges. 3. Follow installation prompts. 4. Restart system after installation completes.
🔧 Temporary Workarounds
Block DGN file execution
windowsPrevent Bentley View from opening DGN files via group policy or application restrictions
Use Windows Group Policy to block .dgn file associations with Bentley View
Run with reduced privileges
windowsConfigure Bentley View to run with limited user privileges instead of administrative rights
Set application compatibility settings to 'Run as invoker'
🧯 If You Can't Patch
- Implement application whitelisting to prevent execution of unauthorized files
- Deploy network segmentation to isolate systems running vulnerable software
🔍 How to Verify
Check if Vulnerable:
Check Bentley View version in Help > About. If version is 10.15.0.75 or earlier, system is vulnerable.Check Version:
wmic product where name="Bentley View" get versionVerify Fix Applied:
Verify Bentley View version is 10.16.02.03 or later in Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Unusual process creation from Bentley View executable
- Multiple failed DGN file parsing attempts
- Crash logs from Bentley View with memory access violations
Network Indicators:
- Downloads of DGN files from untrusted sources
- Network connections initiated by Bentley View to suspicious IPs
SIEM Query:
source="windows" AND process_name="BentleyView.exe" AND (event_id=1 OR event_id=1000 OR event_id=1001)