CVE-2022-28315 in MicroStation CONNECT
Summary
by MITRE • 03/29/2023
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IFC files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16367.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/18/2026
The vulnerability identified as CVE-2022-28315 represents a critical buffer overflow flaw in Bentley MicroStation CONNECT version 10.16.02.34 that enables remote code execution through malicious IFC file manipulation. This vulnerability falls under the CWE-121 stack-based buffer overflow category, where insufficient input validation allows attackers to overwrite adjacent memory locations in the program's stack. The flaw specifically manifests during the parsing of IFC (Industry Foundation Classes) files, which are widely used in building information modeling and engineering applications for data exchange between different software platforms.
The technical implementation of this vulnerability exploits the lack of proper bounds checking when processing user-supplied data within the IFC file parser. When the application encounters an IFC file containing maliciously crafted data, it attempts to copy user-supplied content into a fixed-length stack-based buffer without adequate length validation. This fundamental security gap allows an attacker to overflow the buffer and potentially overwrite the return address or other critical stack variables, thereby gaining control over the program's execution flow. The vulnerability requires user interaction to be exploited, meaning that targets must either visit a malicious webpage or open a specially crafted IFC file, making it a typical client-side attack vector.
From an operational perspective, this vulnerability poses significant risk to organizations relying on Bentley MicroStation for engineering and design work, as it allows remote attackers to execute arbitrary code with the privileges of the currently running process. The attack surface is particularly concerning given that IFC files are commonly shared between different engineering firms and stakeholders, making it relatively easy for attackers to deliver malicious payloads through seemingly legitimate file exchanges. The impact extends beyond simple code execution, as successful exploitation could lead to complete system compromise, data exfiltration, or disruption of critical engineering workflows that depend on the affected software.
Security mitigations for CVE-2022-28315 should prioritize immediate patch application from Bentley, as the vendor has released updates addressing this specific buffer overflow vulnerability. Organizations should implement network-based controls such as web application firewalls and file content filtering to prevent the delivery of malicious IFC files, while also conducting thorough security awareness training for users to recognize potentially malicious file attachments. The ATT&CK framework categorizes this vulnerability under T1203 Exploitation for Client Execution, highlighting the need for layered defense strategies including application whitelisting, sandboxing of file processing, and regular security assessments of engineering software environments. Additionally, system administrators should monitor for unusual network traffic patterns or file access attempts that might indicate exploitation attempts, particularly when dealing with IFC files from untrusted sources.