Actively exploited · Published May 23, 2024 · Assigned by cisa-cg
CVE-2024-4978Malicious Code in Justice AV Solutions (JAVS) Viewer
High 8.4 Exploited
In plain English
A high-severity security flaw in Viewer from Justice AV Solutions. Attackers are actively exploiting it in the wild (listed by CISA on May 29, 2024). The chance it is exploited in the next 30 days is estimated at 26.9% (higher than 98% of all known vulnerabilities). Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Jun 19, 2024.
Official description
Justice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary when executed and is signed with an unexpected authenticode signature. A remote, privileged threat actor may exploit this vulnerability to execute of unauthorized PowerShell commands.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Justice AV Solutions | Viewer | 8.3.7.250 |
Weakness: CWE-506 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
References
- https://twitter.com/2RunJack2/status/1775052981966377148
- https://www.rapid7.com/blog/post/2024/05/23/cve-2024-4978-backdoored-justice-av-solutions-viewer-software-used-in-apparent-supply-chain-attack/
- https://www.javs.com/downloads/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4978 government-resource