CVE-2022-28316
📋 TL;DR
CVE-2022-28316 is a buffer overflow vulnerability in Bentley MicroStation CONNECT that allows remote code execution when users open malicious IFC files. Attackers can exploit this to execute arbitrary code with the privileges of the current user. Users of affected Bentley MicroStation versions are at risk.
💻 Affected Systems
- Bentley MicroStation CONNECT
📦 What is this software?
View by Bentley
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the affected system, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Local privilege escalation leading to unauthorized access to sensitive engineering data, system disruption, or installation of malware.
If Mitigated
Limited impact with proper network segmentation and user privilege restrictions, potentially only affecting the individual workstation.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file) but the vulnerability is well-documented and weaponization is likely given the RCE potential.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.16.02.35 and later
Vendor Advisory: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0006
Restart Required: Yes
Instructions:
1. Download the latest version from Bentley's official website or update through Bentley CONNECTION Client. 2. Install the update following Bentley's installation instructions. 3. Restart the system to complete the installation.
🔧 Temporary Workarounds
Restrict IFC file processing
windowsBlock or restrict processing of IFC files through application controls or file type restrictions
User awareness training
allTrain users to avoid opening IFC files from untrusted sources
🧯 If You Can't Patch
- Implement application whitelisting to prevent execution of unauthorized code
- Restrict user privileges to limit potential damage from successful exploitation
🔍 How to Verify
Check if Vulnerable:
Check MicroStation version in Help > About MicroStation. If version is 10.16.02.34 or earlier, the system is vulnerable.Check Version:
In MicroStation: Help > About MicroStationVerify Fix Applied:
Verify version is 10.16.02.35 or later in Help > About MicroStation.📡 Detection & Monitoring
Log Indicators:
- Unusual process creation from MicroStation
- Multiple failed IFC file parsing attempts
- Abnormal memory usage patterns in MicroStation process
Network Indicators:
- Unexpected outbound connections from MicroStation
- File downloads of IFC files from untrusted sources
SIEM Query:
Process Creation where ParentImage contains "ustation.exe" AND CommandLine contains unusual parameters