FileMaker Apache Commons JAR Replacer

Overview

The FileMaker Apache Commons JAR Replacer is an automation solution that addresses CVE-2025-46295 by replacing vulnerable Apache Commons JAR files in FileMaker Server installations. Instead of upgrading the entire FileMaker Server, this solution follows the official Claris guidance to replace only the vulnerable commons-text and commons-lang3 JAR files with updated versions.

Quick Download

For most users, download the latest release instead of building from source:

Download Latest Release

Go to the Releases page
Download the appropriate file for your platform:
- Windows: filemaker-jar-replacer-windows.zip
- macOS: filemaker-jar-replacer-macos.tar.gz
- Ubuntu/Linux: filemaker-jar-replacer-ubuntu.tar.gz
Extract and run - See the release notes for detailed extraction and usage instructions

Why Use Releases?

✅ Pre-tested - All releases are thoroughly tested across platforms
✅ Ready to use - No compilation or setup required
✅ Secure - Signed releases with checksums for verification
✅ Complete - Includes all dependencies and documentation

Vulnerability Information

When is a server vulnerable?

The affected JAR files are installed only when the Web Publishing Engine is enabled for the first time.

CVE-2025-46295 Details

Severity: Critical
CVSS Score: 9.8 (Critical)
Affected Component: Apache Commons Text (versions prior to 1.10.0) and Apache Commons Lang (versions prior to 3.18.0)
Impact: Remote Code Execution
Affected FileMaker Versions: All versions with vulnerable JAR files
Solution: Replace vulnerable JAR files with updated versions (commons-text 1.11.0+, commons-lang3 3.18.0+)

Official Resources

Manual JAR Replacement Instructions (Without FileMaker Server Upgrade): https://support.claris.com/s/answerview?anum=000049055&language=en_US
CVE-2025-46295 Security Advisory (NIST): https://nvd.nist.gov/vuln/detail/CVE-2025-46295
Vulnerability Acknowledgment & Safe Version Confirmation: https://support.claris.com/s/answerview?anum=000049059&language=en_US

Supported Platforms

This JAR replacer provides platform-specific scripts for:

Windows: PowerShell script (replace-filemaker-jars-windows.ps1)
macOS: Bash script (replace-filemaker-jars-macos.sh)
Ubuntu: Bash script (replace-filemaker-jars-ubuntu.sh)

Quick Start

Prerequisites

Windows

Windows Server 2016+
PowerShell 5.1 or later
Administrator privileges
FileMaker Server installed

macOS

macOS 10.15 (Catalina) or later
Bash shell
sudo privileges
FileMaker Server installed

Ubuntu

Ubuntu 20.04 LTS or later
Bash shell
sudo privileges
FileMaker Server installed

Usage

IMPORTANT: Before making any changes to your FileMaker Server, run the script with the --dry-run option to check if your server is vulnerable and see what changes would be made.

Windows

# Run PowerShell as Administrator

# Show help and available options
.\replace-filemaker-jars-windows.ps1 -Help

# Check if your server is vulnerable (RECOMMENDED FIRST STEP)
.\replace-filemaker-jars-windows.ps1 -DryRun

# Apply the security fix (only after reviewing dry-run results)
.\replace-filemaker-jars-windows.ps1

macOS

# Run with sudo privileges

# Show help and available options
sudo ./replace-filemaker-jars-macos.sh --help

# Check if your server is vulnerable (RECOMMENDED FIRST STEP)
sudo ./replace-filemaker-jars-macos.sh --dry-run

# Apply the security fix (only after reviewing dry-run results)
sudo ./replace-filemaker-jars-macos.sh

Ubuntu

# Run with sudo privileges

# Show help and available options
sudo ./replace-filemaker-jars-ubuntu.sh --help

# Check if your server is vulnerable (RECOMMENDED FIRST STEP)
sudo ./replace-filemaker-jars-ubuntu.sh --dry-run

# Apply the security fix (only after reviewing dry-run results)
sudo ./replace-filemaker-jars-ubuntu.sh

Why Use Dry Run First?

The --dry-run option is the safest way to:

Check vulnerability status without making any changes
Identify which JAR files need to be replaced
Verify script compatibility with your FileMaker Server installation
Preview all actions that would be performed
Detect potential issues before making changes

Always run with --dry-run first to understand what the script will do on your system.

Features

Automated JAR Detection and Replacement

Automatically detects FileMaker Server installations and Web Publishing Engine directories
Identifies vulnerable commons-text and commons-lang3 JAR files
Downloads updated JAR files (commons-text 1.11.0+, commons-lang3 3.18.0+)
Performs atomic JAR file replacement with integrity verification

Comprehensive Backup and Recovery

Creates complete backup of existing JAR files before replacement
Automatic rollback on replacement failure
Backup integrity verification

Web Publishing Engine Management

Uses official fmsadmin command-line tool for service management
Secure credential handling for fmsadmin authentication
Automatic Web Publishing Engine restart after JAR replacement
Post-replacement functionality verification

Security-First Approach

Secure credential handling (never logged or displayed)
Supports environment variables and .env files
Validates file permissions for credential files

Detailed Logging

Comprehensive operation logging with timestamps
Platform-specific log locations
Error tracking and recovery guidance

User-Friendly Interface

Color-coded status indicators
Progress tracking for long operations
Clear error messages and recovery instructions

Directory Structure

filemaker-jar-replacer/
├── README.md                          # This file
├── replace-filemaker-jars-windows.ps1 # Windows PowerShell script
├── replace-filemaker-jars-macos.sh    # macOS Bash script
├── replace-filemaker-jars-ubuntu.sh   # Ubuntu Bash script
├── scripts/
│   ├── windows/
│   │   └── modules/                   # PowerShell modules for JAR operations
│   ├── macos/
│   │   └── modules/                   # Bash function modules for JAR operations
│   ├── ubuntu/
│   │   └── modules/                   # Bash function modules for JAR operations
│   └── shared/                        # Shared utilities and templates
├── config/
│   ├── logging-config.json           # Logging configuration
│   └── jar-replacement-config.json   # JAR replacement configuration
├── tests/                            # Test suite (BATS and Pester)
├── logs/                             # Log files (created during execution)
└── backups/                          # JAR backup files (created during execution)

Configuration

Environment Variables

You can configure the updater using environment variables:

# FileMaker Server credentials
export FILEMAKER_USERNAME="admin"
export FILEMAKER_PASSWORD="your_secure_password"

# Custom paths (optional)
export FILEMAKER_INSTALL_PATH="/custom/path/to/filemaker"
export BACKUP_DIRECTORY="/custom/backup/path"

.env File Support

Create a .env file in the script directory:

# .env file (must have 600 permissions)
FILEMAKER_USERNAME=admin
FILEMAKER_PASSWORD=your_secure_password
BACKUP_DIRECTORY=/custom/backup/path

Important: Ensure .env file has restrictive permissions (600) for security.

Manual JAR Replacement Process (Fallback)

If the automated script fails, follow these manual steps to replace the vulnerable JAR files:

1. Stop Web Publishing Engine

Windows

# Using fmsadmin (recommended)
& "C:\Program Files\FileMaker\FileMaker Server\Database Server\fmsadmin.exe" stop wpe -u admin -p password

# Or using services
Stop-Service "FileMaker Server Web Publishing Engine"

macOS

# Using fmsadmin (recommended)
sudo "/Library/FileMaker Server/Database Server/bin/fmsadmin" stop wpe -u admin -p password

# Or using launchctl
sudo launchctl stop com.filemaker.wpe

Ubuntu

# Using fmsadmin (recommended)
sudo "/opt/FileMaker/FileMaker Server/Database Server/bin/fmsadmin" stop wpe -u admin -p password

# Or using systemctl
sudo systemctl stop filemaker-wpe

2. Backup Existing JAR Files

Windows

$jarPath = "C:\Program Files\FileMaker\FileMaker Server\Web Publishing\publishing-engine\jwpc-tomcat\webapps\ROOT\WEB-INF\lib"
$backupPath = "C:\Temp\jar-backup-$(Get-Date -Format 'yyyyMMdd-HHmmss')"
New-Item -ItemType Directory -Path $backupPath
Copy-Item "$jarPath\commons-text-*.jar" $backupPath
Copy-Item "$jarPath\commons-lang3-*.jar" $backupPath

macOS/Ubuntu

JAR_PATH="/Library/FileMaker Server/Web Publishing/publishing-engine/jwpc-tomcat/webapps/ROOT/WEB-INF/lib"  # macOS
# JAR_PATH="/opt/FileMaker/FileMaker Server/Web Publishing/publishing-engine/jwpc-tomcat/webapps/ROOT/WEB-INF/lib"  # Ubuntu

BACKUP_PATH="/tmp/jar-backup-$(date +%Y%m%d-%H%M%S)"
mkdir -p "$BACKUP_PATH"
cp "$JAR_PATH"/commons-text-*.jar "$BACKUP_PATH/"
cp "$JAR_PATH"/commons-lang3-*.jar "$BACKUP_PATH/"

3. Download Updated JAR Files

Download the following JAR files from Apache Commons:

commons-text-1.11.0.jar or later from: https://commons.apache.org/proper/commons-text/download_text.cgi
commons-lang3-3.18.0.jar or later from: https://commons.apache.org/proper/commons-lang/download_lang.cgi

Verify checksums against official Apache Commons checksums.

4. Replace JAR Files

Windows

$jarPath = "C:\Program Files\FileMaker\FileMaker Server\Web Publishing\publishing-engine\jwpc-tomcat\webapps\ROOT\WEB-INF\lib"
# Remove old JAR files
Remove-Item "$jarPath\commons-text-*.jar"
Remove-Item "$jarPath\commons-lang3-*.jar"
# Copy new JAR files
Copy-Item "commons-text-1.11.0.jar" $jarPath
Copy-Item "commons-lang3-3.18.0.jar" $jarPath

macOS/Ubuntu

JAR_PATH="/Library/FileMaker Server/Web Publishing/publishing-engine/jwpc-tomcat/webapps/ROOT/WEB-INF/lib"  # macOS
# JAR_PATH="/opt/FileMaker/FileMaker Server/Web Publishing/publishing-engine/jwpc-tomcat/webapps/ROOT/WEB-INF/lib"  # Ubuntu

# Remove old JAR files
sudo rm "$JAR_PATH"/commons-text-*.jar
sudo rm "$JAR_PATH"/commons-lang3-*.jar
# Copy new JAR files
sudo cp commons-text-1.11.0.jar "$JAR_PATH/"
sudo cp commons-lang3-3.18.0.jar "$JAR_PATH/"
# Set proper permissions
sudo chown fmserver:fmsadmin "$JAR_PATH"/commons-*.jar  # Adjust ownership as needed
sudo chmod 644 "$JAR_PATH"/commons-*.jar

5. Restart Web Publishing Engine

Windows

# Using fmsadmin (recommended)
& "C:\Program Files\FileMaker\FileMaker Server\Database Server\fmsadmin.exe" start wpe -u admin -p password

# Or using services
Start-Service "FileMaker Server Web Publishing Engine"

macOS

# Using fmsadmin (recommended)
sudo "/Library/FileMaker Server/Database Server/bin/fmsadmin" start wpe -u admin -p password

# Or using launchctl
sudo launchctl start com.filemaker.wpe

Ubuntu

# Using fmsadmin (recommended)
sudo "/opt/FileMaker/FileMaker Server/Database Server/bin/fmsadmin" start wpe -u admin -p password

# Or using systemctl
sudo systemctl start filemaker-wpe

6. Verify JAR Replacement

Check that the Web Publishing Engine is running
Verify new JAR files are in place with correct versions
Test web publishing functionality
Check FileMaker Server logs for any errors

Manual Update Process (Fallback)

If the automated script fails, follow these manual steps:

1. Stop FileMaker Server Services

Windows

net stop "FileMaker Server"

macOS

sudo launchctl stop com.filemaker.fms

Ubuntu

sudo service fmshelper stop

2. Create Backup

Back up your databases from the Data folder
Back up configuration files
Note current version for rollback

3. Download Update

Download FileMaker Server 22.0.4 from Claris
Verify checksum integrity
Run installer with appropriate parameters

4. Verify Installation

Confirm version is 22.0.4 or later
Test database connectivity
Verify services are running

5. Restore Services

Windows

net start "FileMaker Server"

macOS

sudo launchctl start com.filemaker.fms

Ubuntu

sudo service fmshelper start

Troubleshooting

Common Issues

"FileMaker Server not found"

Verify FileMaker Server is installed
Check installation path matches expected locations
Run script with appropriate privileges

"Insufficient privileges"

Run PowerShell as Administrator (Windows)
Use sudo with the script (macOS/Ubuntu)
Verify user account has necessary permissions

"JAR backup creation failed"

Check available disk space
Verify write permissions to backup directory
Ensure JAR files are not locked by running processes

"JAR download failed"

Check internet connectivity
Verify firewall settings allow HTTPS downloads to Apache Commons repositories
Try manual download and place in script directory

"Web Publishing Engine restart failed"

Verify fmsadmin credentials are correct
Check that FileMaker Server is running
Try manual restart using fmsadmin command
Check FileMaker Server logs for service issues

Log Locations

Windows: logs\filemaker-jar-replacer-windows.log
macOS: logs/filemaker-jar-replacer-macos.log
Ubuntu: logs/filemaker-jar-replacer-ubuntu.log

Security Considerations

Always run scripts with appropriate privileges
Verify script integrity before execution
Use secure credential storage methods
Review logs for any security-related events
Test in non-production environment first

Support and Resources

Official Claris Resources

Claris Support: https://support.claris.com/
FileMaker Community: https://community.claris.com/
Security Advisories: https://support.claris.com/s/topic/0TO4u000000TNvGGAW/security-advisories

Emergency Contacts

Claris Technical Support: Available through your support plan
Security Issues: Report to security@claris.com

Testing

This project includes comprehensive test suites for all platforms to ensure reliability and security.

Testing Frameworks

The project uses different testing frameworks for each platform:

Linux/macOS: BATS (Bash Automated Testing System)
Windows: Pester (PowerShell testing framework)

Installing Testing Tools

BATS (Linux/macOS)

macOS (using Homebrew):

brew install bats-core

Ubuntu/Debian:

# Install via package manager
sudo apt update
sudo apt install bats

# Or install latest version from source
git clone https://github.com/bats-core/bats-core.git
cd bats-core
sudo ./install.sh /usr/local

Manual Installation (any Unix-like system):

git clone https://github.com/bats-core/bats-core.git
cd bats-core
sudo ./install.sh /usr/local

Pester (Windows)

Pester comes pre-installed with PowerShell 5.1+ and Windows PowerShell, but you may want to update to the latest version:

# Check current version
Get-Module -Name Pester -ListAvailable

# Install/Update to latest version (PowerShell 5.1+)
Install-Module -Name Pester -Force -SkipPublisherCheck

# For PowerShell Core (7+)
Install-Module -Name Pester -Scope CurrentUser

Running Tests

All Platforms - Individual Test Files

# Run specific BATS test file (Linux/macOS)
bats tests/backup-creation.bats
bats tests/version-detection.bats

# Run specific Pester test file (Windows)
Invoke-Pester tests/windows/Integration.Tests.ps1
Invoke-Pester tests/windows/Utilities.Tests.ps1

All Platforms - Full Test Suite

# Run all BATS tests (Linux/macOS)
bats tests/*.bats

# Run all Pester tests (Windows)
Invoke-Pester tests/windows/

Test Categories

The test suite includes:

Unit Tests: Individual function and module testing
Integration Tests: End-to-end workflow testing
Security Tests: Credential handling and permission validation
Platform-Specific Tests: OS-specific functionality validation
Edge Case Tests: Error handling and boundary condition testing

Test Environment Setup

Tests create isolated temporary environments and do not affect your system or FileMaker installation. However, some tests may require:

Administrator/sudo privileges (for privilege escalation tests)
Network access (for download simulation tests)
Sufficient disk space (for backup creation tests)

License

This JAR replacer is provided as-is for addressing CVE-2025-46295. Use in accordance with your FileMaker Server license agreement and Apache Commons license terms.

Changelog

Version 1.0.0

Initial release
Support for Windows, macOS, and Ubuntu
Automated JAR replacement for CVE-2025-46295
commons-text and commons-lang3 JAR file replacement
Comprehensive logging and backup functionality
Web Publishing Engine management with fmsadmin integration

Name		Name	Last commit message	Last commit date
Latest commit History 62 Commits
.github/workflows		.github/workflows
.kiro		.kiro
config		config
docs		docs
release		release
scripts		scripts
tests		tests
.gitattributes		.gitattributes
.gitignore		.gitignore
README.md		README.md
TODO.md		TODO.md
replace-filemaker-jars-macos.sh		replace-filemaker-jars-macos.sh
replace-filemaker-jars-ubuntu.sh		replace-filemaker-jars-ubuntu.sh
replace-filemaker-jars-windows.ps1		replace-filemaker-jars-windows.ps1

soliantconsulting/CVE-2025-46295-fix-fms

Folders and files

Latest commit

History

Repository files navigation

FileMaker Apache Commons JAR Replacer

Overview

Quick Download

Download Latest Release

Why Use Releases?

Vulnerability Information

When is a server vulnerable?

CVE-2025-46295 Details

Official Resources

Supported Platforms

Quick Start

Prerequisites

Windows

macOS

Ubuntu

Usage

Windows

macOS

Ubuntu

Why Use Dry Run First?

Features

Automated JAR Detection and Replacement

Comprehensive Backup and Recovery

Web Publishing Engine Management

Security-First Approach

Detailed Logging

User-Friendly Interface

Directory Structure

Configuration

Environment Variables

.env File Support

Manual JAR Replacement Process (Fallback)

1. Stop Web Publishing Engine

Windows

macOS

Ubuntu

2. Backup Existing JAR Files

Windows

macOS/Ubuntu

3. Download Updated JAR Files

4. Replace JAR Files

Windows

macOS/Ubuntu

5. Restart Web Publishing Engine

Windows

macOS

Ubuntu

6. Verify JAR Replacement

Manual Update Process (Fallback)

1. Stop FileMaker Server Services

Windows

macOS

Ubuntu

2. Create Backup

3. Download Update

4. Verify Installation

5. Restore Services

Windows

macOS

Ubuntu

Troubleshooting

Common Issues

"FileMaker Server not found"

"Insufficient privileges"

"JAR backup creation failed"

"JAR download failed"

"Web Publishing Engine restart failed"

Log Locations

Security Considerations

Support and Resources

Official Claris Resources

Emergency Contacts

Testing

Testing Frameworks

Installing Testing Tools

Packages