CVE-2022-28310 in MicroStation CONNECT
Summary
by MITRE • 03/29/2023
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.034. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16339.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/17/2026
The vulnerability identified as CVE-2022-28310 represents a critical remote code execution flaw in Bentley MicroStation CONNECT version 10.16.02.034, a widely used computer-aided design software platform. This vulnerability falls under the category of improper input validation and specifically manifests within the software's handling of SKP (SketchUp) file formats, which are commonly used for 3D modeling and design documentation. The flaw is particularly dangerous because it enables attackers to execute arbitrary code on vulnerable systems without requiring elevated privileges, making it a significant concern for organizations that rely on this design software for their engineering and architectural workflows. The vulnerability is classified as a buffer overflow or heap-based memory corruption issue that stems from insufficient validation of object existence before operations are performed on these objects.
The technical implementation of this vulnerability occurs during the parsing process of SKP files where the software fails to properly validate whether objects exist before attempting to perform operations on them. This lack of proper validation creates a condition where an attacker can craft a malicious SKP file containing specially constructed data that triggers the vulnerability when the software attempts to parse and render the file. According to CWE standards, this corresponds to CWE-476, Null Pointer Dereference, where the application fails to check for null pointers before dereferencing them, and potentially CWE-121, Stack-based Buffer Overflow, if the vulnerability allows for buffer manipulation. The exploitation requires user interaction through either visiting a malicious webpage that serves the vulnerable SKP file or opening the file directly, making it a typical client-side attack vector that relies on social engineering tactics to succeed.
The operational impact of this vulnerability extends beyond simple code execution, as it allows attackers to operate within the security context of the current process, potentially gaining access to sensitive design data, system resources, or even escalating privileges depending on the user's access level. Organizations using Bentley MicroStation in their design processes face significant risk, particularly in environments where design files are shared between multiple stakeholders or when users may inadvertently open malicious files from untrusted sources. The vulnerability's presence in a widely deployed design platform means that successful exploitation could compromise entire design projects, potentially affecting infrastructure projects, architectural designs, or engineering specifications that are critical to business operations. Attackers leveraging this vulnerability could access proprietary design information, modify project files, or establish persistent access points within the organization's network.
Mitigation strategies for CVE-2022-28310 should prioritize immediate patching of affected systems, as Bentley has released updates addressing this vulnerability. Organizations should implement strict file validation policies that prevent automatic opening of potentially malicious files, particularly those from untrusted sources or external collaborators. Network-based controls such as web application firewalls and content filtering systems can help block malicious SKP files from being downloaded or accessed. Additionally, user education and awareness programs should emphasize the dangers of opening unknown or unverified files, especially in collaborative design environments where file sharing is common. Security teams should monitor for suspicious file access patterns and implement least-privilege principles for users accessing design software, limiting the potential impact should exploitation occur. The vulnerability's classification under ATT&CK technique T1203, Exploitation for Client Execution, highlights the need for defensive measures that specifically target client-side exploitation vectors, including endpoint protection solutions that can detect and block malicious file processing activities.