CVE-2024-4978 Overview
CVE-2024-4978 is a critical supply chain vulnerability affecting Justice AV Solutions (JAVS) Viewer Setup version 8.3.7.250-1. The installer contains a malicious binary that is signed with an unexpected authenticode signature, enabling remote threat actors with privileged access to execute unauthorized PowerShell commands on affected systems. This represents a sophisticated supply chain compromise where legitimate software distribution channels were weaponized to deliver malicious payloads.
Critical Impact
This vulnerability is actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Organizations using JAVS Viewer in courtrooms and legal environments are at significant risk of unauthorized remote code execution.
Affected Products
- Justice AV Solutions (JAVS) Viewer version 8.3.7.250-1
- JAVS Viewer installer packages distributed during the compromise period
- Systems that installed the backdoored JAVS Viewer software
Discovery Timeline
- May 23, 2024 - CVE-2024-4978 published to NVD
- October 24, 2025 - Last updated in NVD database
Technical Details for CVE-2024-4978
Vulnerability Analysis
This vulnerability represents a supply chain attack where the legitimate JAVS Viewer installer was compromised to include embedded malicious code (CWE-506: Embedded Malicious Code). The attack is particularly concerning because the malicious binary was signed with an authenticode signature, which would typically be trusted by Windows systems and security software. The malicious code enables execution of arbitrary PowerShell commands, providing attackers with a powerful foothold for further exploitation.
The attack requires network access and privileged authentication, combined with user interaction to execute the installer. However, given that JAVS Viewer is commonly deployed in courtrooms and legal proceedings environments, the potential for sensitive data exposure and system compromise is significant. Once the backdoored installer is executed, threat actors can remotely execute PowerShell commands, enabling data exfiltration, lateral movement, and persistent access.
Root Cause
The root cause of CVE-2024-4978 is the inclusion of embedded malicious code within the JAVS Viewer installer package. The malicious binary was inserted into the software supply chain and signed with an authenticode certificate to appear legitimate. This represents a compromise of the software build or distribution infrastructure, allowing attackers to inject malicious functionality into otherwise trusted software.
Attack Vector
The attack is delivered via network-accessible distribution channels. The exploitation flow involves:
- Distribution: The backdoored installer is downloaded from compromised distribution points
- Execution: A user with administrative privileges executes the malicious installer
- Payload Activation: The embedded malicious code establishes communication with attacker infrastructure
- Command Execution: Remote threat actors execute unauthorized PowerShell commands on the compromised system
- Persistence: The malware establishes persistence mechanisms for continued access
The attack leverages the trust placed in signed software installers, bypassing initial security controls that rely on code signing verification.
Detection Methods for CVE-2024-4978
Indicators of Compromise
- Presence of JAVS Viewer version 8.3.7.250-1 installed on systems
- Unexpected PowerShell command execution originating from JAVS Viewer processes
- Network connections to unusual command-and-control infrastructure from JAVS-related processes
- Authenticode signatures on JAVS binaries that differ from expected vendor certificates
Detection Strategies
- Monitor for PowerShell execution spawned by JAVS Viewer processes or child processes
- Implement file integrity monitoring on installed JAVS Viewer components
- Verify authenticode signatures against known-good JAVS signing certificates
- Review installation logs for evidence of JAVS Viewer 8.3.7.250-1 deployment
- Deploy behavioral detection for supply chain attack patterns including signed-but-malicious executables
Monitoring Recommendations
- Enable PowerShell script block logging and module logging across all endpoints
- Implement network monitoring for suspicious outbound connections from courtroom and legal environment systems
- Configure SIEM alerts for JAVS Viewer process anomalies
- Monitor for lateral movement patterns following JAVS Viewer installation events
How to Mitigate CVE-2024-4978
Immediate Actions Required
- Immediately isolate any systems running JAVS Viewer version 8.3.7.250-1
- Conduct forensic analysis on affected systems to determine scope of compromise
- Re-image affected systems from known-clean backups after forensic preservation
- Review network logs for evidence of command-and-control communications
- Update to a clean, verified version of JAVS Viewer from the JAVS Downloads Page
Patch Information
Organizations should obtain a verified clean version of JAVS Viewer directly from Justice AV Solutions. Before installation, verify the authenticode signature matches the legitimate JAVS signing certificate. Given this is a supply chain compromise, it is critical to confirm the integrity of any downloaded installer before deployment. Consult the Rapid7 Analysis on CVE-2024-4978 for detailed technical information about the compromise.
This vulnerability is tracked in the CISA Known Exploited Vulnerabilities Catalog, and federal agencies are required to remediate according to CISA timelines.
Workarounds
- Block execution of JAVS Viewer 8.3.7.250-1 via application control policies
- Implement network segmentation to isolate courtroom AV systems from critical infrastructure
- Deploy endpoint detection and response (EDR) solutions to monitor for post-exploitation activity
- Enable PowerShell Constrained Language Mode on systems where JAVS Viewer is deployed
- Implement strict application whitelisting to prevent execution of unauthorized PowerShell commands
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
