CVE-2021-46655
📋 TL;DR
CVE-2021-46655 is a use-after-free vulnerability in Bentley View's JT file parser that allows remote code execution. Attackers can exploit this by tricking users into opening malicious JT files or visiting malicious web pages. Users of affected Bentley View versions are at risk.
💻 Affected Systems
- Bentley View
📦 What is this software?
View by Bentley
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining the same privileges as the current user, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Arbitrary code execution in the context of the current user, allowing file system access, credential harvesting, and installation of malware.
If Mitigated
Limited impact with proper application sandboxing and user privilege restrictions, potentially only affecting the application process.
🎯 Exploit Status
Exploitation requires user interaction but no authentication. The vulnerability was discovered by Zero Day Initiative (ZDI-CAN-15630).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.16.0.61 or later
Vendor Advisory: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
Restart Required: Yes
Instructions:
1. Download Bentley View version 10.16.0.61 or later from Bentley's official website. 2. Run the installer. 3. Restart the system after installation completes.
🔧 Temporary Workarounds
Disable JT file association
windowsRemove the file association for .jt files to prevent automatic opening in Bentley View
Control Panel > Default Programs > Associate a file type or protocol with a program > Select .jt > Change program > Choose another application
Application sandboxing
windowsRun Bentley View in a sandboxed environment to limit potential damage
🧯 If You Can't Patch
- Implement strict email filtering to block JT file attachments
- Use application control policies to restrict execution of Bentley View to trusted locations only
🔍 How to Verify
Check if Vulnerable:
Check Bentley View version: Open Bentley View > Help > About. If version is 10.15.0.75 or earlier, the system is vulnerable.Check Version:
In Bentley View: Help > AboutVerify Fix Applied:
Verify Bentley View version is 10.16.0.61 or later. Test opening known-safe JT files to ensure functionality is preserved.📡 Detection & Monitoring
Log Indicators:
- Application crashes in Bentley View with JT file access
- Unusual process creation from Bentley View executable
Network Indicators:
- Downloads of JT files from untrusted sources
- Outbound connections from Bentley View to suspicious IPs
SIEM Query:
Process Creation where Image contains 'BentleyView.exe' AND ParentImage contains 'explorer.exe' AND CommandLine contains '.jt'