CVE-2021-46643 in View
Summary
by MITRE • 02/18/2022
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15515.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 02/19/2022
This vulnerability represents a critical buffer overflow flaw in Bentley View 10.15.0.75 that enables remote code execution through malicious DGN file manipulation. The vulnerability stems from inadequate input validation during the parsing of DGN (Design Graphics Network) files, which are commonly used in engineering and architectural design applications. When a user opens a specially crafted malicious DGN file, the application fails to properly validate the length of user-supplied data before copying it into a stack-based buffer, creating an exploitable condition that can be leveraged by remote attackers.
The technical implementation of this vulnerability aligns with CWE-121 Stack-based Buffer Overflow, where insufficient bounds checking allows an attacker to overwrite adjacent memory locations on the stack. This type of vulnerability typically occurs when developers assume fixed-size buffers without validating input lengths against buffer capacity, creating opportunities for attackers to inject malicious code that can overwrite return addresses and function pointers. The flaw specifically manifests during DGN file parsing operations where the application processes user-controlled data without proper length verification before memory copying operations.
The operational impact of this vulnerability extends beyond simple code execution, as it allows attackers to operate within the security context of the current process with elevated privileges. This means that successful exploitation could result in complete system compromise, data theft, or persistence mechanisms being established on the victim's machine. The requirement for user interaction through visiting a malicious page or opening a malicious file makes this vulnerability particularly dangerous in targeted attack scenarios where social engineering can be employed to deliver the payload.
Organizations using Bentley View software should implement immediate mitigations including updating to patched versions of the application, implementing strict file access controls, and monitoring for suspicious DGN file activity. The vulnerability demonstrates the importance of input validation practices as outlined in the OWASP Top Ten and aligns with ATT&CK technique T1203 Exploitation for Client Execution, where adversaries leverage application vulnerabilities to execute malicious code on target systems. Security administrators should also consider network-based mitigations such as file type restrictions and sandboxing mechanisms to reduce the attack surface and prevent exploitation attempts from reaching vulnerable systems.