Justice AV Solutions (JAVS) Viewer Supply Chain Attack & Backdoor Vulnerability (CVE-2024-4978)

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2024-4978) stems from a supply chain compromise where the Justice AV Solutions (JAVS) Viewer Setup version 8.3.7.250-1 installer was distributed containing a malicious binary. The installer was signed with an unexpected Authenticode signature, allowing it to bypass standard operating system trust controls and execute a backdoor payload upon installation (CWE-506).

2. Exploitation Mechanics & Attack Scenario

When an unsuspecting user executes the compromised installer, the embedded malicious binary is deployed. Once active, the backdoor establishes a channel that allows a remote, privileged threat actor to execute arbitrary PowerShell commands on the host. By leveraging a valid (though unexpected) digital signature, the malware evades traditional antivirus and EDR detection mechanisms during initial execution.

3. Infrastructure & Business Impact

Since JAVS Viewer is widely deployed in sensitive environments such as courtrooms, law enforcement agencies, and government legal departments, a successful compromise could lead to unauthorized access to confidential legal records, tampering with evidence, and lateral movement within critical government networks. Due to active exploitation in the wild, this vulnerability has been added to the CISA KEV catalog.

1. Official Patch & Version Upgrade Commands

Administrators must immediately uninstall the compromised version and deploy a clean, verified release. Use the following PowerShell commands to audit and remove the affected JAVS Viewer version:

# Audit installed JAVS Viewer versions
Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like '*JAVS*' } | Select-Object Name, Version

# Force uninstallation of the compromised version (8.3.7.250-1)
$app = Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like '*JAVS*' -and $_.Version -eq '8.3.7.250-1' }
if ($app) {
    Write-Host 'Warning: Malicious JAVS version detected. Uninstalling...'
    $app.Uninstall()
} else {
    Write-Host 'Malicious JAVS version not found via standard WMI.'
}

2. Temporary Workaround & Hardening Configuration

To mitigate potential lateral movement and unauthorized command execution, restrict PowerShell execution policies and block outbound network connections for the JAVS application directory.

# Restrict PowerShell execution policy to signed scripts only
Set-ExecutionPolicy -ExecutionPolicy AllSigned -Scope LocalMachine -Force

# Block outbound network traffic for JAVS binaries via Windows Firewall
New-NetFirewallRule -DisplayName 'Block Malicious JAVS Outbound' -Direction Outbound -Program '%ProgramFiles%\JAVS\*.exe' -Action Block

3. Log Audit & IoC Verification Commands

Inspect system event logs for suspicious PowerShell activity and verify the digital signatures of installed binaries to identify potential indicators of compromise (IoCs).

# Query event logs for suspicious or encoded PowerShell executions
Get-WinEvent -ProviderName 'Microsoft-Windows-PowerShell' -MaxEvents 100 | 
    Where-Object { $_.Message -like '*-enc*' -or $_.Message -like '*bypass*' } | 
    Format-List TimeCreated, Id, Message