CVE-2021-46647
📋 TL;DR
CVE-2021-46647 is a heap-based buffer overflow vulnerability in Bentley MicroStation CONNECT's BMP image parser. Attackers can execute arbitrary code by tricking users into opening malicious BMP files or visiting malicious web pages. This affects users of Bentley MicroStation CONNECT version 10.16.0.80.
💻 Affected Systems
- Bentley MicroStation CONNECT
📦 What is this software?
View by Bentley
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with remote code execution in the context of the current user, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Malicious actors deliver weaponized BMP files via phishing or compromised websites, leading to initial access and subsequent payload execution.
If Mitigated
With proper security controls, exploitation attempts are blocked by endpoint protection, and user awareness prevents opening suspicious files.
🎯 Exploit Status
Exploitation requires user interaction but is straightforward once malicious content is delivered.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to version 10.16.1 or later
Vendor Advisory: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0002
Restart Required: Yes
Instructions:
1. Download the latest MicroStation CONNECT update from Bentley's official website. 2. Run the installer with administrative privileges. 3. Restart the system after installation completes.
🔧 Temporary Workarounds
Block BMP file extensions
windowsPrevent MicroStation from processing BMP files via group policy or application control.
Use Windows Group Policy to block .bmp file associations for MicroStation
User awareness training
allEducate users to avoid opening BMP files from untrusted sources.
🧯 If You Can't Patch
- Restrict MicroStation to trusted users only and monitor for suspicious activity.
- Implement application whitelisting to prevent execution of unauthorized processes.
🔍 How to Verify
Check if Vulnerable:
Check MicroStation version via Help > About. If version is 10.16.0.80, it is vulnerable.Check Version:
In MicroStation, navigate to Help > About to view version.Verify Fix Applied:
Verify version is 10.16.1 or later in Help > About.📡 Detection & Monitoring
Log Indicators:
- Unusual process creation from MicroStation (e.g., cmd.exe, powershell.exe)
- Failed attempts to load malicious BMP files in application logs
Network Indicators:
- Outbound connections from MicroStation to unknown IPs post-BMP file opening
SIEM Query:
Process Creation where ParentImage contains 'MicroStation' AND (Image contains 'cmd.exe' OR Image contains 'powershell.exe')