CVE-2021-34899

Vulnerability

A heap buffer overflow vulnerability exists in Bentley View 10.15.0.75 during parsing of JT files. The flaw occurs when crafted data in a JT file triggers a write past the end of an allocated buffer. No special configuration is required; any user opening a malicious JT file is vulnerable. Affected versions include Bentley View 10.15.0.75 and potentially earlier or later versions as part of the MicroStation and MicroStation-based applications family identified in BE-2021-0005 [1][2].

Exploitation

An attacker must convince a user to open a maliciously crafted JT file (e.g., via a web page, email attachment, or file share). No authentication or prior access is needed. The exploit requires no special privileges; user interaction in the form of opening the file is the only trigger. The crafted JT file causes an out-of-bounds write, which can be leveraged to execute arbitrary code in the context of the current process [2].

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the current Bentley View process. This can lead to full compromise of confidentiality, integrity, and availability of the affected system. The CVSS v3.1 score is 7.8, reflecting high impact [1][2].

Mitigation

Bentley Systems released BE-2021-0005 on 2021-12-07 addressing this vulnerability. Users should update Bentley View and any MicroStation-based applications to the latest version provided by Bentley. No workarounds are offered by the vendor. The vulnerability is not listed in CISA KEV as of this writing [1][2].