CVE-2022-28320
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code by tricking users into opening malicious 3DM files in Bentley View. Attackers can gain control of the current process. Users of Bentley View 10.16.02.022 are affected.
💻 Affected Systems
- Bentley View
📦 What is this software?
View by Bentley
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the user's system through arbitrary code execution.
Likely Case
Attacker executes malicious code within the Bentley View process context, potentially leading to data theft, ransomware deployment, or lateral movement.
If Mitigated
Limited impact with proper file validation and user awareness preventing malicious file execution.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file) but the vulnerability itself is unauthenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to version 10.16.03 or later
Vendor Advisory: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0002
Restart Required: Yes
Instructions:
1. Open Bentley View
2. Navigate to Help > Check for Updates
3. Follow prompts to install latest version
4. Restart Bentley View after installation
🔧 Temporary Workarounds
Disable 3DM file association
windowsPrevent Bentley View from automatically opening 3DM files
Control Panel > Default Programs > Associate a file type or protocol with a program > Change .3dm association to another program
User awareness training
allTrain users to avoid opening 3DM files from untrusted sources
🧯 If You Can't Patch
- Implement application whitelisting to block unauthorized executables
- Use network segmentation to isolate Bentley View systems from critical assets
🔍 How to Verify
Check if Vulnerable:
Check Bentley View version in Help > About. If version is exactly 10.16.02.022, system is vulnerable.Check Version:
In Bentley View: Help > AboutVerify Fix Applied:
Verify version is 10.16.03 or later in Help > About.📡 Detection & Monitoring
Log Indicators:
- Unexpected process crashes of Bentley View
- Unusual file access patterns for 3DM files
Network Indicators:
- Downloads of 3DM files from untrusted sources
- Outbound connections from Bentley View to unknown IPs
SIEM Query:
Process: BentleyView.exe AND (FileExtension: .3dm OR ProcessCrash: true)