CVE-2021-46627

Vulnerability

This vulnerability is a use-after-free flaw in the parsing of DXF files within Bentley View 10.15.0.75 and all versions prior to 10.16.02.* [1][2]. The issue arises because the software does not validate the existence of an object before performing operations on it, leading to a use-after-free condition when processing specially crafted DXF data [1]. The same vulnerability also affects MicroStation versions prior to 10.16.02.* [2].

Exploitation

To exploit this vulnerability, an attacker must convince a user to open a malicious DXF file or visit a malicious page that triggers the parsing [1]. No authentication is required, but user interaction is necessary. The attacker crafts a DXF file containing data that, when parsed, triggers the use-after-free, allowing the attacker to control the program flow [1][2].

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the current process [1][2]. This can lead to full compromise of confidentiality, integrity, and availability, as the attacker gains the same privileges as the user running Bentley View [1][2].

Mitigation

Bentley has addressed this vulnerability in version 10.16.02.* and later of both Bentley View and MicroStation [2]. Users should update to the latest versions as soon as possible. As a general best practice, only open DXF files from trusted sources [2]. No workaround is available for unpatched versions.