CVE-2022-28309
📋 TL;DR
CVE-2022-28309 is an out-of-bounds read vulnerability in Bentley View's 3DS file parser that allows remote attackers to disclose sensitive information. Users of Bentley View 10.16.02.022 who open malicious 3DS files or visit malicious web pages are affected. This vulnerability can be combined with other flaws to potentially execute arbitrary code.
💻 Affected Systems
- Bentley View
📦 What is this software?
View by Bentley
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise when combined with other vulnerabilities, allowing attackers to install malware, steal data, or pivot to other systems.
Likely Case
Information disclosure through memory leaks, potentially exposing sensitive data like credentials, session tokens, or application memory contents.
If Mitigated
Limited impact with proper security controls like application sandboxing, memory protection, and restricted user privileges preventing escalation.
🎯 Exploit Status
Exploitation requires user interaction and combining with other vulnerabilities for code execution. Information disclosure is more straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to Bentley View version 10.16.03 or later
Vendor Advisory: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0003
Restart Required: Yes
Instructions:
1. Download latest Bentley View from official Bentley website. 2. Run installer. 3. Restart system after installation completes.
🔧 Temporary Workarounds
Block 3DS file extensions
windowsPrevent Bentley View from opening 3DS files via file association blocking
reg add "HKCU\Software\Classes\.3ds" /ve /d "txtfile" /f
reg add "HKLM\Software\Classes\.3ds" /ve /d "txtfile" /f
Application sandboxing
windowsRun Bentley View in restricted environment using Windows Sandbox or similar
🧯 If You Can't Patch
- Implement application whitelisting to prevent execution of untrusted 3DS files
- Deploy email/web filtering to block malicious 3DS file attachments and downloads
🔍 How to Verify
Check if Vulnerable:
Check Bentley View version via Help > About. If version is 10.16.02.022 or earlier, system is vulnerable.Check Version:
wmic datafile where name="C:\\Program Files\\Bentley\\Bentley View\\BentleyView.exe" get versionVerify Fix Applied:
Verify Bentley View version is 10.16.03 or later via Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Application crashes when opening 3DS files
- Unusual memory access patterns in application logs
- Security software alerts for out-of-bounds memory reads
Network Indicators:
- Downloads of 3DS files from untrusted sources
- Network traffic to known malicious domains after file opening
SIEM Query:
EventID=1000 OR EventID=1001 AND SourceName="Application Error" AND ProcessName="BentleyView.exe" AND FaultingModule LIKE "%3ds%"