CVE-2022-28301
📋 TL;DR
This is a buffer overflow vulnerability in Bentley MicroStation CONNECT that allows remote code execution when users open malicious IFC files. Attackers can exploit this to run arbitrary code with the privileges of the current user. Users of affected MicroStation versions who open untrusted IFC files are at risk.
💻 Affected Systems
- Bentley MicroStation CONNECT
📦 What is this software?
View by Bentley
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the affected system, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Local privilege escalation leading to data exfiltration, installation of backdoors, or disruption of engineering workflows.
If Mitigated
Limited impact with proper segmentation and user privilege restrictions, potentially only affecting the MicroStation process without system-wide compromise.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file) but the vulnerability is well-documented and buffer overflow exploitation techniques are mature.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.16.02.35 and later
Vendor Advisory: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0006
Restart Required: Yes
Instructions:
1. Download the latest MicroStation CONNECT update from Bentley's official website or through the Bentley CONNECTION Client. 2. Run the installer with administrative privileges. 3. Restart the system after installation completes.
🔧 Temporary Workarounds
Disable IFC file association
windowsRemove IFC file type association with MicroStation to prevent automatic opening
Control Panel > Default Programs > Associate a file type or protocol with a program > Select .ifc > Change program > Choose another application
Restrict IFC file execution
windowsUse application control policies to block execution of IFC files in MicroStation
🧯 If You Can't Patch
- Implement strict network segmentation to isolate MicroStation systems from critical infrastructure
- Apply principle of least privilege by running MicroStation with limited user accounts and disabling administrative privileges
🔍 How to Verify
Check if Vulnerable:
Check MicroStation version in Help > About MicroStation. If version is 10.16.02.34 or earlier, the system is vulnerable.Check Version:
In MicroStation: Help > About MicroStationVerify Fix Applied:
Verify version is 10.16.02.35 or later in Help > About MicroStation after applying the update.📡 Detection & Monitoring
Log Indicators:
- Unusual process creation from MicroStation.exe
- Multiple failed IFC file parsing attempts
- Memory access violations in application logs
Network Indicators:
- Unexpected outbound connections from MicroStation process
- File downloads of IFC files from untrusted sources
SIEM Query:
process_name:"MicroStation.exe" AND (event_id:4688 OR parent_process_name:"explorer.exe") AND command_line:"*.ifc"