Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code Vulnerability

Technical Severity

CVSS v3.1 Metrics

HIGH

8.4 / 10

Minimal Risk Critical

Vector Specification

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Exploitation Likelihood

EPSS Prediction

14.15 %

Predictive Probability

Percentile Rank

94.2 th

Documented as more likely to be exploited than 94.2% of known CVEs.

Detection Date

May 29, 2024

Remediation Due

Jun 19, 2024

CISA Catalog Active

Threat Analysis

Justice AV Solutions (JAVS) Viewer installer contains a malicious version of ffmpeg.exe, named fffmpeg.exe (SHA256: 421a4ad2615941b177b6ec4ab5e239c14e62af2ab07c6df1741e2a62223223c4). When run, this creates a backdoor connection to a malicious C2 server.

Remediation Directive

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Asset Context

Vendor Identity

Justice AV Solutions

Affected Product

Viewer

Ransomware Status

Campaign Use Unknown

Weakness Classification

CWE-506

External Intelligence

Please follow the vendor’s instructions as outlined in the public statements at

https://www.rapid7.com/blog/post/2024/05/23/cve-2024-4978-backdoored-justice-av-solutions-viewer-software-used-in-apparent-supply-chain-attack#remediation

NVD

National Vulnerability Database

https://nvd.nist.gov/vuln/detail/CVE-2024-4978