CVE-2024-4978
Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code Vulnerability
Description
CVE-2024-4978 is a high-severity supply chain compromise affecting Justice AV Solutions (JAVS) Viewer Setup version 8.3.7.250-1, where the legitimate installer was trojanized with a malicious binary capable of executing unauthorized PowerShell commands. With a CVSS v3.1 base score of 8.4, the backdoored installer was signed with an unexpected authenticode signature, indicating that the software supply chain was compromised at the distribution level. CISA has added CVE-2024-4978 to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 19, 2024, and the ransomware association is currently unknown. Its EPSS score of 14.15% at the 94.2nd percentile indicates high exploitation probability, reflecting the severity of a supply chain attack targeting courtroom audio-visual recording software used throughout the U.S. justice system.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| javs | javs viewer | 8.3.7.250 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
References
- https://twitter.com/2RunJack2/status/1775052981966377148(Third Party Advisory)
- https://www.javs.com/downloads/(Broken Link, Product)
- https://www.rapid7.com/blog/post/2024/05/23/cve-2024-4978-backdoored-justice-av-solutions-viewer-software-used-in-apparent-supply-chain-attack/(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4978(US Government Resource)
Weakness Type
Supply Chain Compromise via Trojanized Installer
CVE-2024-4978 represents a supply chain attack where the official JAVS Viewer installer was compromised to include a malicious payload. The vulnerability is not a traditional software bug but rather a deliberate insertion of malicious code into the legitimate software distribution chain. The trojanized installer version 8.3.7.250-1 contained a backdoor binary that was signed with a different authenticode certificate than the legitimate JAVS software, indicating the attacker replaced the genuine binary with a malicious one during or after the build process. When users downloaded and installed what they believed to be a legitimate update, they unknowingly installed malware capable of executing arbitrary PowerShell commands on their systems. Supply chain attacks are particularly dangerous because they exploit the inherent trust relationship between software vendors and their customers. Learn more about supply chain compromise at CWE-506.
Impact Analysis
The impact of CVE-2024-4978 is severe and far-reaching due to the nature of the targeted software and the environments where it is deployed. Confidentiality is fully compromised because the backdoor's ability to execute arbitrary PowerShell commands provides the attacker with complete access to all data on affected systems. JAVS Viewer is used in courtrooms across the United States for audio-visual recording of legal proceedings, meaning compromised systems may contain highly sensitive legal data, case evidence, and personally identifiable information.
Integrity faces maximum impact since arbitrary PowerShell execution allows the attacker to modify files, install additional malware, create persistence mechanisms, and potentially tamper with courtroom recordings or other legal evidence. The implications of evidence tampering in a judicial context are extraordinarily serious.
Availability is completely at risk as the attacker can deploy destructive payloads, encrypt files, or disable systems through the PowerShell execution capability. The changed scope (S:C) in the CVSS vector indicates that the impact extends beyond the JAVS Viewer application to affect the entire host system and potentially connected network resources. The high privilege requirement (PR:H) reflects that the attacker needed elevated access to the software supply chain to inject the malicious code, but from the victim's perspective, no special privileges are needed — simply installing the software triggers the compromise. The EPSS score at the 94.2nd percentile confirms significant exploitation across the installed base.
Exploit Maturity
CVE-2024-4978 represents a confirmed supply chain compromise with active exploitation. CISA has included it in the Known Exploited Vulnerabilities catalog with a remediation deadline of June 19, 2024. The EPSS score of 14.15% at the 94.2nd percentile reflects substantial exploitation probability driven by the fact that any organization that downloaded and installed the compromised version was automatically exploited.
Rapid7 published a detailed technical analysis of the supply chain attack at rapid7.com, documenting how the trojanized installer was distributed through the official JAVS download infrastructure. The malicious binary within the installer was signed with an authenticode certificate that did not match the legitimate JAVS signing certificate, providing a detection mechanism for identifying compromised installations. Early public reporting of the suspicious installer was noted on social media before the formal CVE assignment.
The ransomware association remains unknown, but the PowerShell execution capability means the backdoor could be used to deploy any payload, including ransomware. The targeting of courtroom recording software in the U.S. justice system suggests a potentially sophisticated threat actor with specific interest in judicial proceedings and legal data.
Remediation
-
Immediately uninstall JAVS Viewer version 8.3.7.250 and reimage affected systems. Simply uninstalling the software is insufficient because the malicious payload may have established persistence mechanisms outside the application directory. Any system that had version 8.3.7.250-1 installed should be treated as fully compromised and reimaged from a known-clean baseline.
-
Verify the authenticode signature on all JAVS installations. Check the digital signature of installed JAVS binaries against the legitimate JAVS signing certificate. The trojanized installer was signed with a different certificate, making signature verification a reliable detection method. Any binaries signed with an unrecognized certificate should be flagged for investigation.
-
Conduct a forensic investigation on all affected systems. Perform full forensic analysis on systems where the compromised version was installed, including analysis of PowerShell execution logs, network connection history, file system changes, and any data exfiltration indicators. Given the sensitive nature of courtroom data, engage incident response professionals with experience handling legal system compromises.
-
Reset all credentials accessible from compromised systems. Any passwords, authentication tokens, certificates, or other credentials that were stored on or accessible from affected systems should be considered compromised and rotated immediately. This includes domain credentials, database passwords, and any service accounts.
-
Install a verified clean version of JAVS Viewer. After reimaging, obtain a fresh copy of JAVS Viewer from the vendor through a verified channel and confirm the authenticode signature matches the legitimate JAVS certificate before installation. Implement application whitelisting and code signing verification policies to prevent similar supply chain attacks in the future.
Technical Details
CVE-2024-4978 is a supply chain compromise in Justice AV Solutions Viewer with a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H, resulting in a high base score of 8.4. The network attack vector (AV:N) reflects that the trojanized installer was distributed over the network through the vendor's download infrastructure. The low attack complexity (AC:L) indicates that no special conditions are needed for the malicious payload to activate — it executes automatically during the installation process.
The high privilege requirement (PR:H) in the CVSS vector represents the attacker's need for elevated access to the JAVS software distribution infrastructure to replace the legitimate installer with the trojanized version. The required user interaction (UI:R) reflects that a user must initiate the installation process, though from the victim's perspective, they are simply performing a routine software update. The changed scope (S:C) indicates that compromise extends beyond the JAVS application to the underlying operating system and network.
The malicious binary embedded in JAVS Viewer Setup 8.3.7.250-1 was designed to execute unauthorized PowerShell commands upon installation. The binary was signed with an authenticode certificate that did not match the legitimate JAVS code signing certificate, suggesting the attacker either compromised the build system and used their own signing key, or intercepted the distribution channel to swap the signed binary. Once installed, the backdoor provided the attacker with a persistent command execution capability on the victim system, with the full impact spanning confidentiality (C:H), integrity (I:H), and availability (A:H) of both the application and the host system.
Frequently Asked Questions
What is CVE-2024-4978?
CVE-2024-4978 is a supply chain compromise where the official Justice AV Solutions (JAVS) Viewer installer version 8.3.7.250-1 was trojanized with a malicious binary that executes unauthorized PowerShell commands. It has a CVSS v3.1 score of 8.4 and was actively exploited against organizations using JAVS courtroom recording software.
What is JAVS Viewer and who uses it?
JAVS Viewer is courtroom audio-visual recording software widely used throughout the United States justice system. It is installed on systems within courtrooms and legal facilities to record, manage, and play back judicial proceedings. The supply chain compromise potentially affected any organization that installed the trojanized version.
How can I tell if my JAVS installation is compromised?
Check the authenticode digital signature on the installed JAVS binaries. The trojanized version 8.3.7.250-1 was signed with a certificate that does not match the legitimate JAVS signing certificate. Additionally, review PowerShell execution logs and network connections for any suspicious activity originating from the system.
Is uninstalling the software sufficient to remove the threat?
No. Simply uninstalling JAVS Viewer is not sufficient because the malicious payload may have established additional persistence mechanisms, installed secondary malware, or exfiltrated credentials. Affected systems should be fully reimaged from a known-clean baseline, and all accessible credentials should be rotated.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.