CVE-2021-34934

Vulnerability

This vulnerability, identified as ZDI-CAN-14912, affects Bentley View version 10.15.0.75 [1][2]. The flaw exists within the parsing of JT files and results from the lack of proper validation of user-supplied data, which can lead to a memory corruption condition [2]. The vulnerability is part of a larger set of issues disclosed in Bentley advisory BE-2021-0005, covering multiple CVEs in MicroStation and MicroStation-based applications [1].

Exploitation

Exploitation requires user interaction [2]. An attacker must convince the target to visit a malicious page or open a malicious JT file [2]. No additional privileges or authentication are needed, but the attacker must craft a specially crafted JT file that triggers the memory corruption during parsing [1][2].

Impact

Successful exploitation allows the attacker to execute arbitrary code in the context of the current process [2]. This could lead to complete compromise of the affected system's confidentiality, integrity, and availability, given the CVSS scope of [1][2].

Mitigation

Bentley released fixes as part of security update BE-2021-0005, with a publication date of 2021-12-07 [1]. Users should update Bentley View to a version incorporating these fixes [1]. No public workarounds have been provided, and the issue is not listed in the CISA KEV at this time.