CVE-2022-28312
📋 TL;DR
This vulnerability in Bentley MicroStation CONNECT allows remote attackers to disclose sensitive information by exploiting a buffer read overflow when parsing malicious 3DS files. Attackers can leverage this with other vulnerabilities to potentially execute arbitrary code. Users of affected Bentley MicroStation versions who open untrusted 3DS files are at risk.
💻 Affected Systems
- Bentley MicroStation CONNECT
📦 What is this software?
View by Bentley
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within networks.
Likely Case
Information disclosure and potential application crash, possibly enabling further exploitation when combined with other vulnerabilities.
If Mitigated
Limited to denial of service or minor information leakage if proper file handling controls are implemented.
🎯 Exploit Status
Requires user interaction to open malicious file. Known as ZDI-CAN-16342 with advisory ZDI-22-602.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.16.02.035 and later
Vendor Advisory: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0003
Restart Required: Yes
Instructions:
1. Download latest MicroStation CONNECT version from Bentley's official site. 2. Run installer with administrative privileges. 3. Restart system after installation completes.
🔧 Temporary Workarounds
Restrict 3DS file handling
windowsBlock or restrict opening of 3DS files in MicroStation through application settings or group policy.
File extension filtering
windowsUse Windows file blocking policies to prevent opening of .3ds files from untrusted sources.
🧯 If You Can't Patch
- Implement strict file handling policies to prevent opening untrusted 3DS files
- Use application whitelisting to restrict MicroStation execution to trusted environments only
🔍 How to Verify
Check if Vulnerable:
Check MicroStation version in Help > About. If version is 10.16.02.034 or earlier, system is vulnerable.Check Version:
In MicroStation: Help > About MicroStation CONNECTVerify Fix Applied:
Verify version is 10.16.02.035 or later in Help > About dialog.📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing 3DS files
- Unexpected memory access errors in application logs
Network Indicators:
- Downloads of 3DS files from untrusted sources
- Unusual outbound connections after file processing
SIEM Query:
source="MicroStation" AND (event="crash" OR event="exception") AND file_extension="3ds"