CVE-2024-4978: Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code Vulnerability

CISA Known Exploited Vulnerability (KEV)

Description

Justice AV Solutions (JAVS) Viewer installer contains a malicious version of ffmpeg.exe, named fffmpeg.exe (SHA256: 421a4ad2615941b177b6ec4ab5e239c14e62af2ab07c6df1741e2a62223223c4). When run, this creates a backdoor connection to a malicious C2 server.

Required action (CISA)

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

Please follow the vendor’s instructions as outlined in the public statements at https://www.rapid7.com/blog/post/2024/05/23/cve-2024-4978-backdoored-justice-av-solutions-viewer-software-used-in-apparent-supply-chain-attack#remediation and https://www.javs.com/downloads; https://nvd.nist.gov/vuln/detail/CVE-2024-4978

Weakness behind it

CISA records this vulnerability as an instance of CWE-506. From there the chain continues into CAPEC attack patterns and ATT&CK techniques, all inside this corpus.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-4978
• KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog