CVE-2024-4978
📋 TL;DR
CVE-2024-4978 is a supply chain attack where Justice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary signed with an unexpected authenticode signature. This allows remote privileged threat actors to execute unauthorized PowerShell commands. Organizations using this specific version of Justice AV Solutions Viewer software are affected.
💻 Affected Systems
- Justice AV Solutions Viewer
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with remote code execution, data exfiltration, lateral movement across networks, and persistent backdoor installation.
Likely Case
Unauthorized PowerShell command execution leading to data theft, credential harvesting, or deployment of additional malware.
If Mitigated
Limited impact with proper endpoint protection, application allowlisting, and network segmentation preventing command execution.
🎯 Exploit Status
Exploitation requires the malicious binary to be executed, typically through installation of the compromised software package.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Remove version 8.3.7.250-1 and install clean version from vendor
Vendor Advisory: https://www.javs.com/downloads/
Restart Required: Yes
Instructions:
1. Uninstall Justice AV Solutions Viewer 8.3.7.250-1 completely
2. Download fresh installer from official vendor site
3. Install clean version
4. Verify digital signatures match expected vendor certificates
🔧 Temporary Workarounds
Block PowerShell Execution
windowsRestrict PowerShell execution through Group Policy or application control
Set-ExecutionPolicy -ExecutionPolicy Restricted -Scope LocalMachine
Application Allowlisting
windowsConfigure Windows Defender Application Control to only allow trusted applications
🧯 If You Can't Patch
- Immediately isolate affected systems from network
- Perform forensic analysis to check for compromise indicators
🔍 How to Verify
Check if Vulnerable:
Check installed version of Justice AV Solutions Viewer. If version is 8.3.7.250-1, system is vulnerable.Check Version:
Get-WmiObject -Class Win32_Product | Where-Object {$_.Name -like '*Justice AV*'} | Select-Object Name, VersionVerify Fix Applied:
Verify Justice AV Solutions Viewer is not version 8.3.7.250-1 and check digital signatures of binaries match expected vendor certificates.📡 Detection & Monitoring
Log Indicators:
- Unexpected PowerShell execution from Justice AV Viewer process
- Authenticode signature validation failures for javs binaries
- Process creation events for suspicious commands
Network Indicators:
- Outbound connections from Justice AV Viewer to unexpected destinations
- DNS queries for command and control domains
SIEM Query:
source="windows" (process_name="powershell.exe" AND parent_process="*JusticeAV*") OR (event_id="4688" AND process_name="*javs*" AND command_line="*powershell*")🔗 References
- https://twitter.com/2RunJack2/status/1775052981966377148
- https://www.javs.com/downloads/
- https://www.rapid7.com/blog/post/2024/05/23/cve-2024-4978-backdoored-justice-av-solutions-viewer-software-used-in-apparent-supply-chain-attack/
- https://twitter.com/2RunJack2/status/1775052981966377148
- https://www.javs.com/downloads/
- https://www.rapid7.com/blog/post/2024/05/23/cve-2024-4978-backdoored-justice-av-solutions-viewer-software-used-in-apparent-supply-chain-attack/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4978
