CVE-2022-43651
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on affected Bentley View installations by tricking users into opening malicious SKP files. The flaw exists in how Bentley View handles SKP file parsing, specifically a use-after-free condition that can be exploited to gain code execution. Users of vulnerable Bentley View versions are affected.
💻 Affected Systems
- Bentley View
📦 What is this software?
View by Bentley
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the affected system, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Local privilege escalation leading to compromise of the user account and potentially the workstation, with possible data exfiltration or malware installation.
If Mitigated
Limited impact due to application sandboxing or restricted user privileges, potentially resulting in application crash rather than full compromise.
🎯 Exploit Status
Exploitation requires user interaction but the vulnerability is well-documented and weaponization is likely given the RCE potential
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.16.03 and later
Vendor Advisory: https://www.bentley.com/en/common-vulnerability-exposure/CVE-2022-43651
Restart Required: Yes
Instructions:
1. Download Bentley View version 10.16.03 or later from official Bentley website. 2. Run the installer. 3. Follow installation prompts. 4. Restart the application.
🔧 Temporary Workarounds
Disable SKP file association
windowsRemove Bentley View as the default handler for SKP files to prevent automatic opening
Control Panel > Default Programs > Associate a file type or protocol with a program > Select .skp > Change program > Choose another application
User awareness training
allTrain users not to open SKP files from untrusted sources
🧯 If You Can't Patch
- Implement application whitelisting to block execution of malicious code
- Use endpoint protection with behavioral analysis to detect exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check Bentley View version in Help > About. If version is earlier than 10.16.03, the system is vulnerable.Check Version:
In Bentley View: Help > AboutVerify Fix Applied:
Verify version is 10.16.03 or later in Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Application crashes with SKP file processing
- Unusual process creation from Bentley View executable
Network Indicators:
- Outbound connections from Bentley View to unusual destinations
- File downloads triggered by Bentley View
SIEM Query:
Process Creation where Image contains 'BentleyView.exe' and CommandLine contains '.skp'