CVE-2022-28645 in MicroStation CONNECT
Summary
by MITRE • 03/29/2023
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. Crafted data in a DGN file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-16470.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 05/20/2026
This vulnerability in Bentley MicroStation CONNECT 10.16.02.34 represents a critical buffer overread flaw that exposes sensitive information and potentially enables arbitrary code execution. The issue stems from inadequate input validation during the parsing of DGN (Design Graphics Network) files, which are native file formats used extensively in computer-aided design and engineering applications. The vulnerability specifically manifests when the software processes malformed DGN files containing crafted data that causes the application to read beyond the boundaries of allocated memory buffers. This type of flaw falls under CWE-125, known as "Out-of-bounds Read," which is classified as a common weakness in software security implementations. The vulnerability requires user interaction to be exploited, meaning that an attacker must convince a target to open a maliciously crafted DGN file, typically through social engineering tactics or by hosting the file on a compromised website.
The technical implementation of this vulnerability demonstrates how seemingly benign file parsing operations can become attack vectors when proper bounds checking is absent. When the MicroStation application encounters a specially crafted DGN file, the buffer overread condition occurs during the parsing phase where the software attempts to access memory locations beyond the intended buffer boundaries. This behavior can result in information disclosure, where adjacent memory contents are read and potentially exposed to the attacker, or more critically, can provide a pathway for code execution if the attacker can control the data that gets read. The vulnerability's classification as a remote information disclosure issue means that attackers can potentially access sensitive data without requiring physical access to the target system, making it particularly dangerous in enterprise environments where design files are frequently shared and exchanged.
The operational impact of this vulnerability extends beyond simple information disclosure to potentially enable full system compromise through privilege escalation or lateral movement within networked environments. In enterprise settings where Bentley MicroStation is widely deployed for architectural, engineering, and construction projects, the attack surface is extensive as these applications are often used by multiple users and integrated into complex workflows involving various stakeholders. The vulnerability's potential for arbitrary code execution places it within the ATT&CK framework's technique T1059.007 for Command and Scripting Interpreter, as successful exploitation could allow attackers to execute malicious code within the context of the running application. This makes the vulnerability particularly concerning for organizations that do not maintain strict network segmentation or have limited visibility into file handling operations within their design environments.
Mitigation strategies for this vulnerability should focus on both immediate remediation and long-term security hardening measures. Organizations should prioritize applying the vendor-provided patches and updates as soon as they become available, as the vulnerability exists in the specific version mentioned and represents a known issue that has been addressed by the software vendor. Additionally, implementing strict file validation procedures, including sandboxing of file downloads and restricting user access to potentially malicious file types, can help reduce the attack surface. Network-based mitigations such as content filtering and web application firewalls can help prevent users from accessing malicious DGN files through web-based delivery mechanisms. From a defensive perspective, organizations should also consider implementing monitoring solutions that can detect anomalous file handling behavior or unusual memory access patterns that might indicate exploitation attempts. The vulnerability serves as a reminder of the importance of proper input validation and bounds checking in security-critical applications, particularly in software that handles complex file formats and user-generated content within enterprise environments.