CVE-2022-28316 in MicroStation CONNECT
Summary
by MITRE • 03/29/2023
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IFC files. Crafted data in an IFC file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16368.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 05/18/2026
CVE-2022-28316 represents a critical buffer overflow vulnerability affecting Bentley MicroStation CONNECT version 10.16.02.34 that enables remote code execution through crafted IFC (Industry Foundation Classes) files. This vulnerability resides in the file parsing mechanism that processes IFC data structures, specifically when handling malformed or maliciously constructed IFC content. The flaw manifests as a write past the end of an allocated buffer, which occurs during the parsing of IFC file metadata and geometric data representations. This type of vulnerability maps directly to CWE-121, which describes stack-based buffer overflow conditions, and also aligns with CWE-787, representing out-of-bounds write vulnerabilities that can lead to arbitrary code execution.
The exploitation of this vulnerability requires user interaction through either visiting a malicious webpage that loads the vulnerable IFC file or opening a specially crafted IFC document directly within the application. This user interaction requirement places the vulnerability in the context of social engineering attacks where attackers must convince targets to interact with malicious content. The attack vector demonstrates how web-based delivery mechanisms can be used to exploit desktop applications, creating a bridge between web and desktop security domains. The vulnerability affects the application's ability to properly validate and sanitize input data from IFC files, which are commonly used in construction and engineering industries for exchanging building information modeling data between different software platforms.
The operational impact of this vulnerability extends beyond simple code execution, as it allows attackers to operate within the security context of the current user process, potentially escalating privileges or accessing sensitive system resources. This represents a significant threat to organizations that rely heavily on Bentley MicroStation for engineering and design work, as the application typically runs with elevated privileges in professional environments. The vulnerability's exploitation could lead to complete system compromise, data exfiltration, or the installation of persistent backdoors. Attackers could leverage this vulnerability to gain unauthorized access to critical infrastructure design data, potentially affecting construction projects, building safety, and intellectual property.
Organizations should implement immediate mitigations including restricting access to IFC file handling capabilities, implementing application whitelisting policies, and deploying network-based intrusion detection systems to monitor for suspicious IFC file transfers. The vulnerability also highlights the importance of keeping engineering software updated, as this specific issue was addressed in subsequent releases of Bentley MicroStation. Security teams should consider implementing sandboxing techniques for IFC file processing and establishing strict file validation procedures before opening any IFC content. Additionally, user awareness training should emphasize the dangers of opening untrusted IFC files from unknown sources, as this vulnerability requires human interaction to be successfully exploited. The ATT&CK framework categorizes this vulnerability under T1203, which involves exploiting vulnerabilities in applications that handle file formats, and potentially T1059 for the execution of malicious code once the vulnerability is successfully exploited.