CVE-2022-1229
📋 TL;DR
CVE-2022-1229 is a buffer overflow vulnerability in Bentley MicroStation CONNECT that allows remote code execution when users open malicious IFC files. Attackers can exploit this to run arbitrary code with the privileges of the current user. Users of affected Bentley MicroStation versions are at risk.
💻 Affected Systems
- Bentley MicroStation CONNECT
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via arbitrary code execution with user privileges, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Malware installation or data exfiltration when users open malicious IFC files from untrusted sources.
If Mitigated
No impact if patched or if users avoid opening untrusted IFC files.
🎯 Exploit Status
User interaction required (opening malicious file), but exploitation is straightforward once the file is opened.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.16.2.035 and later
Vendor Advisory: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0006
Restart Required: Yes
Instructions:
1. Download the latest version from Bentley's official website or update through Bentley CONNECTION Client. 2. Install the update. 3. Restart the system.
🔧 Temporary Workarounds
Block IFC file extensions
windowsPrevent opening of IFC files at the system or network level
Windows: Use Group Policy to block .ifc file execution
Email filters: Block .ifc attachments
User awareness training
allTrain users to avoid opening IFC files from untrusted sources
🧯 If You Can't Patch
- Restrict user permissions to limit damage from successful exploitation
- Implement application whitelisting to prevent unauthorized executables from running
🔍 How to Verify
Check if Vulnerable:
Check MicroStation version via Help > About. If version is 10.16.2.034 or earlier, system is vulnerable.Check Version:
In MicroStation: Help > About, or check registry: HKEY_LOCAL_MACHINE\SOFTWARE\Bentley\MicroStation\10.0\VersionVerify Fix Applied:
Verify version is 10.16.2.035 or later in Help > About dialog.📡 Detection & Monitoring
Log Indicators:
- Application crashes when opening IFC files
- Unusual process creation from MicroStation
Network Indicators:
- Downloads of IFC files from suspicious sources
- Outbound connections after opening IFC files
SIEM Query:
Process creation where parent process contains 'MicroStation' AND (command line contains '.ifc' OR file path contains '.ifc')