CVE-2022-28642
📋 TL;DR
CVE-2022-28642 is a buffer overflow vulnerability in Bentley MicroStation CONNECT that allows remote code execution when users open malicious DGN files. Attackers can exploit this to run arbitrary code with the privileges of the current user. Users of affected Bentley MicroStation versions are at risk.
💻 Affected Systems
- Bentley MicroStation CONNECT
📦 What is this software?
View by Bentley
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the affected system, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Local privilege escalation leading to unauthorized access to sensitive files and system resources, potentially enabling further attacks.
If Mitigated
Limited impact with proper security controls, potentially resulting in application crash but no code execution.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file) but the vulnerability is well-documented and weaponization is likely given the RCE potential.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.16.02.35 and later
Vendor Advisory: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0004
Restart Required: Yes
Instructions:
1. Download the latest version from Bentley's official website. 2. Run the installer. 3. Follow installation prompts. 4. Restart the system.
🔧 Temporary Workarounds
Restrict DGN file handling
windowsConfigure system to open DGN files only with trusted applications or block DGN files from untrusted sources.
Application control policies
windowsImplement application whitelisting to prevent execution of unauthorized code.
🧯 If You Can't Patch
- Implement strict file handling policies to prevent opening DGN files from untrusted sources.
- Use network segmentation to isolate systems running vulnerable software from critical assets.
🔍 How to Verify
Check if Vulnerable:
Check MicroStation version via Help > About menu. If version is 10.16.02.34 or earlier, the system is vulnerable.Check Version:
Not applicable - check via application GUIVerify Fix Applied:
Verify version is 10.16.02.35 or later in Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing DGN files
- Unusual process creation from MicroStation executable
Network Indicators:
- Downloads of DGN files from untrusted sources
- Outbound connections from MicroStation to suspicious IPs
SIEM Query:
Process Creation where Image contains 'ustation.exe' and CommandLine contains '.dgn'