CVE-2022-28310
📋 TL;DR
CVE-2022-28310 is a use-after-free vulnerability in Bentley MicroStation CONNECT that allows remote code execution when a user opens a malicious SKP file. Attackers can exploit this to execute arbitrary code with the privileges of the current user. This affects users of Bentley MicroStation CONNECT who open untrusted SKP files.
💻 Affected Systems
- Bentley MicroStation CONNECT
📦 What is this software?
View by Bentley
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via arbitrary code execution with user privileges, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Malware installation or data exfiltration when users open malicious SKP files from untrusted sources.
If Mitigated
Limited impact with proper patching and user awareness training about opening untrusted files.
🎯 Exploit Status
Requires user interaction to open malicious SKP file. ZDI-CAN-16339 indicates professional research.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to version 10.16.02.035 or later
Vendor Advisory: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0009
Restart Required: Yes
Instructions:
1. Download latest MicroStation CONNECT update from Bentley Systems. 2. Run installer with administrative privileges. 3. Restart system after installation completes.
🔧 Temporary Workarounds
Block SKP file extensions
windowsPrevent processing of SKP files via application control or email filtering
User awareness training
allTrain users not to open SKP files from untrusted sources
🧯 If You Can't Patch
- Implement application whitelisting to block MicroStation execution
- Use network segmentation to isolate MicroStation systems from critical assets
🔍 How to Verify
Check if Vulnerable:
Check MicroStation version via Help > About. If version is 10.16.02.034 or earlier, system is vulnerable.Check Version:
Not applicable - check via GUI Help > About menuVerify Fix Applied:
Verify version is 10.16.02.035 or later in Help > About dialog.📡 Detection & Monitoring
Log Indicators:
- Unexpected MicroStation crashes when opening SKP files
- Process creation from MicroStation with unusual command lines
Network Indicators:
- Downloads of SKP files from untrusted sources
- Outbound connections from MicroStation process to unknown IPs
SIEM Query:
Process creation where parent_process contains 'MicroStation' and command_line contains unusual patterns