replace-filemaker-jars-windows.ps1

#!/usr/bin/env powershell
<#
.SYNOPSIS
    FileMaker Apache Commons JAR Replacer for Windows (PowerShell 5.1 Compatible)
    Addresses CVE-2025-46295 vulnerability by replacing vulnerable JAR files

.DESCRIPTION
    This script automates the process of replacing vulnerable Apache Commons JAR files
    in FileMaker Server on Windows systems to address the CVE-2025-46295 security 
    vulnerability. Compatible with PowerShell 5.1+.

.PARAMETER DryRun
    Show what would be done without making changes

.PARAMETER Help
    Display help information

.EXAMPLE
    .\replace-filemaker-jars-windows.ps1 -DryRun
    Show what would be done without making changes

.EXAMPLE
    .\replace-filemaker-jars-windows.ps1
    Run the JAR replacement process

.NOTES
    Requires Administrator privileges
    Compatible with PowerShell 5.1+
    JAR files are replaced directly without stopping services

.LINK
    CVE-2025-46295: https://nvd.nist.gov/vuln/detail/CVE-2025-46295
#>

[CmdletBinding()]
param(
    [Parameter(Mandatory = $false)]
    [switch]$DryRun,
    
    [Parameter(Mandatory = $false)]
    [switch]$Help
)

# Script configuration - Read version from VERSION file
$versionFile = "$PSScriptRoot\release\VERSION"
if (Test-Path $versionFile) {
    $script:ScriptVersion = (Get-Content $versionFile -Raw).Trim()
} else {
    $script:ScriptVersion = "1.0.10"  # Fallback version
}
$script:CommonsTextVersion = "1.11.0"
$script:CommonsLangVersion = "3.18.0"

# Display help if requested
if ($Help) {
    Write-Host ""
    Write-Host "FileMaker Apache Commons JAR Replacer for Windows v$script:ScriptVersion" -ForegroundColor Cyan
    Write-Host "Addresses CVE-2025-46295 vulnerability by replacing vulnerable JAR files" -ForegroundColor Cyan
    Write-Host ""
    Write-Host "USAGE:" -ForegroundColor White
    Write-Host "  .\replace-filemaker-jars-windows.ps1 [parameters]" -ForegroundColor Gray
    Write-Host ""
    Write-Host "PARAMETERS:" -ForegroundColor White
    Write-Host "  -DryRun    Show what would be done without making changes" -ForegroundColor Gray
    Write-Host "  -Help      Display this help message" -ForegroundColor Gray
    Write-Host ""
    Write-Host "EXAMPLES:" -ForegroundColor White
    Write-Host "  .\replace-filemaker-jars-windows.ps1" -ForegroundColor Gray
    Write-Host "    Run with default settings" -ForegroundColor DarkGray
    Write-Host ""
    Write-Host "  .\replace-filemaker-jars-windows.ps1 -DryRun" -ForegroundColor Gray
    Write-Host "    Show what would be done without making changes" -ForegroundColor DarkGray
    Write-Host ""
    Write-Host "REQUIREMENTS:" -ForegroundColor White
    Write-Host "  - Administrator privileges" -ForegroundColor Gray
    Write-Host "  - FileMaker Server installed" -ForegroundColor Gray
    Write-Host "  - Internet connection for JAR file download" -ForegroundColor Gray
    Write-Host "  - PowerShell 5.1 or later" -ForegroundColor Gray
    Write-Host ""
    Write-Host "WHAT THIS TOOL DOES:" -ForegroundColor White
    Write-Host "  - Detects FileMaker Server installations and vulnerable JAR files" -ForegroundColor Gray
    Write-Host "  - Downloads updated Apache Commons Text ($script:CommonsTextVersion) and Lang ($script:CommonsLangVersion) JAR files" -ForegroundColor Gray
    Write-Host "  - Creates backups of existing JAR files before replacement" -ForegroundColor Gray
    Write-Host "  - Replaces vulnerable JAR files with secure versions" -ForegroundColor Gray
    Write-Host "  - Provides comprehensive logging and error recovery" -ForegroundColor Gray
    Write-Host "  - No service restart required - changes take effect when Web Publishing Engine is next used" -ForegroundColor Gray
    Write-Host ""
    Write-Host "Documentation:" -ForegroundColor Cyan
    Write-Host "  - CVE-2025-46295 Details: https://nvd.nist.gov/vuln/detail/CVE-2025-46295" -ForegroundColor Blue
    Write-Host "  - Claris Security Advisory: https://support.claris.com/s/answerview?anum=000049055`&language=en_US" -ForegroundColor Blue
    Write-Host ""
    exit 0
}

# Check if running as Administrator
function Test-Administrator {
    $currentUser = [Security.Principal.WindowsIdentity]::GetCurrent()
    $principal = New-Object Security.Principal.WindowsPrincipal($currentUser)
    return $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
}

# Write colored output functions
function Write-InfoMessage {
    param([string]$Message, [string]$Details = "")
    Write-Host "[+] " -ForegroundColor Green -NoNewline
    Write-Host $Message -ForegroundColor Green
    if ($Details) {
        Write-Host "    $Details" -ForegroundColor Gray
    }
}

function Write-WarningMessage {
    param([string]$Message, [string]$Details = "")
    Write-Host "[!] " -ForegroundColor Yellow -NoNewline
    Write-Host $Message -ForegroundColor Yellow
    if ($Details) {
        Write-Host "    $Details" -ForegroundColor Gray
    }
}

function Write-ErrorMessage {
    param([string]$Message, [string]$Details = "")
    Write-Host "[X] " -ForegroundColor Red -NoNewline
    Write-Host $Message -ForegroundColor Red
    if ($Details) {
        Write-Host "    $Details" -ForegroundColor Gray
    }
}

# Show final vulnerability status prominently
function Show-FinalVulnerabilityStatus {
    param(
        [int]$VulnerableCount,
        [int]$WarVulnerableCount,
        [string]$Mode
    )
    
    Write-Host ""
    Write-Host "===============================================================" -ForegroundColor DarkGray
    
    if ($VulnerableCount -gt 0) {
        Write-Host " VULNERABILITY STATUS: VULNERABLE" -ForegroundColor Red
        Write-Host " CVE-2025-46295 affects this FileMaker Server" -ForegroundColor Red
        if ($Mode -eq "dry_run") {
            Write-Host " Run without -DryRun to apply security fixes" -ForegroundColor Yellow
        }
    } elseif ($WarVulnerableCount -gt 0) {
        Write-Host " VULNERABILITY STATUS: POTENTIALLY VULNERABLE" -ForegroundColor Yellow
        Write-Host " Vulnerable JARs found in WAR files (not currently deployed)" -ForegroundColor Yellow
        Write-Host " Server will be vulnerable if Web Publishing Engine is enabled" -ForegroundColor Yellow
    } else {
        Write-Host " VULNERABILITY STATUS: SECURE" -ForegroundColor Green
        Write-Host " No CVE-2025-46295 vulnerabilities detected" -ForegroundColor Green
    }
    
    Write-Host "===============================================================" -ForegroundColor DarkGray
    Write-Host ""
}

# Get FileMaker Server version
function Get-FileMakerVersion {
    param([string]$InstallPath)
    
    $versionFile = "$InstallPath\Web Publishing\publishing-engine\node-wip\buildVersion.json"
    if (Test-Path $versionFile) {
        try {
            $versionContent = Get-Content $versionFile -Raw | ConvertFrom-Json
            return $versionContent.buildVersion
        }
        catch {
            return "Unknown"
        }
    }
    return "Unknown"
}

# Find FileMaker Server installations
# Find FileMaker Server installations using service detection
function Get-FileMakerInstallations {
    $installations = @()
    
    # First try to find FileMaker Server via Windows service
    try {
        $service = Get-WmiObject -Class Win32_Service | Where-Object { $_.Name -eq "FileMaker Server" }
        if ($service -and $service.PathName) {
            # Extract installation path from service executable path
            # Service path is like: "C:\Program Files\FileMaker\FileMaker Server\Database Server\fmshelper.exe"
            $servicePath = $service.PathName.Trim('"')
            if (Test-Path $servicePath) {
                # Get the FileMaker Server root directory (two levels up from Database Server\fmshelper.exe)
                $installPath = Split-Path (Split-Path $servicePath -Parent) -Parent
                
                if (Test-Path $installPath) {
                    $version = Get-FileMakerVersion -InstallPath $installPath
                    
                    # Check if WPE is deployed (JAR directory exists)
                    $jarDirectory = "$installPath\Web Publishing\publishing-engine\jwpc-tomcat\fmi\WEB-INF\lib"
                    $hasVulnerable = $false
                    $vulnerableJars = @()
                    
                    if (Test-Path $jarDirectory) {
                        # WPE is deployed - check for vulnerable JARs
                        $hasVulnerable = Test-VulnerableJars -JarDirectory $jarDirectory
                        $vulnerableJars = if ($hasVulnerable) { Get-VulnerableJarList -JarDirectory $jarDirectory } else { @() }
                    }
                    
                    # Always check WAR file for potential vulnerabilities
                    $warCheck = Test-VulnerableJarsInWar -InstallPath $installPath
                    
                    $installation = [PSCustomObject]@{
                        InstallPath = $installPath
                        Version = $version
                        JarDirectory = $jarDirectory
                        HasVulnerableJars = $hasVulnerable
                        VulnerableJars = $vulnerableJars
                        WarCheck = $warCheck
                    }
                    $installations += $installation
                }
            }
        }
    }
    catch {
        Write-Host "Service detection failed: $($_.Exception.Message)" -ForegroundColor Yellow
    }
    
    # Fallback to common paths if service detection failed
    if ($installations.Count -eq 0) {
        $commonPaths = @(
            "C:\Program Files\FileMaker\FileMaker Server",
            "C:\Program Files (x86)\FileMaker\FileMaker Server"
        )
        
        foreach ($path in $commonPaths) {
            if (Test-Path $path) {
                $version = Get-FileMakerVersion -InstallPath $path
                
                # Check if WPE is deployed (JAR directory exists)
                $jarDirectory = "$path\Web Publishing\publishing-engine\jwpc-tomcat\fmi\WEB-INF\lib"
                $hasVulnerable = $false
                $vulnerableJars = @()
                
                if (Test-Path $jarDirectory) {
                    # WPE is deployed - check for vulnerable JARs
                    $hasVulnerable = Test-VulnerableJars -JarDirectory $jarDirectory
                    $vulnerableJars = if ($hasVulnerable) { Get-VulnerableJarList -JarDirectory $jarDirectory } else { @() }
                }
                
                # Always check WAR file for potential vulnerabilities
                $warCheck = Test-VulnerableJarsInWar -InstallPath $path
                
                $installation = [PSCustomObject]@{
                    InstallPath = $path
                    Version = $version
                    JarDirectory = $jarDirectory
                    HasVulnerableJars = $hasVulnerable
                    VulnerableJars = $vulnerableJars
                    WarCheck = $warCheck
                }
                $installations += $installation
            }
        }
    }
    
    return $installations
}

# Get list of vulnerable JAR files in lib directory
function Get-VulnerableJarList {
    param([string]$JarDirectory)
    
    $vulnerableJars = @()
    
    # Find commons-text 1.x versions (all are vulnerable)
    $textFiles = Get-ChildItem -Path $JarDirectory -Name "commons-text-1.*.jar" -ErrorAction SilentlyContinue
    if ($textFiles) {
        if ($textFiles -is [array]) {
            $vulnerableJars += $textFiles
        } else {
            $vulnerableJars += @($textFiles)
        }
    }
    
    # Find commons-lang3 3.0-3.17 versions (vulnerable)
    $langFiles = Get-ChildItem -Path $JarDirectory -Name "commons-lang3-3.*.jar" -ErrorAction SilentlyContinue
    if ($langFiles) {
        foreach ($file in $langFiles) {
            # Extract version number and check if vulnerable
            if ($file -match "commons-lang3-3\.(\d+)\.") {
                $minorVersion = [int]$matches[1]
                if ($minorVersion -le 17) {
                    $vulnerableJars += $file
                }
            }
        }
    }
    
    return $vulnerableJars
}

# Check for vulnerable JAR files in WAR file
function Test-VulnerableJarsInWar {
    param([string]$InstallPath)
    
    $warFile = "$InstallPath\Web Publishing\publishing-engine\jwpc.war"
    if (-not (Test-Path $warFile)) {
        return @{
            HasVulnerableJars = $false
            VulnerableJars = @()
            WarFile = $null
        }
    }
    
    try {
        # Load the WAR file as a ZIP archive
        Add-Type -AssemblyName System.IO.Compression.FileSystem
        $archive = [System.IO.Compression.ZipFile]::OpenRead($warFile)
        
        $vulnerableJars = @()
        
        foreach ($entry in $archive.Entries) {
            if ($entry.Name -like "*.jar") {
                # Check for commons-text 1.x versions (vulnerable if < 1.11.0)
                if ($entry.Name -match "commons-text-1\.(\d+)\.(\d+)") {
                    $minorVersion = [int]$matches[1]
                    $patchVersion = [int]$matches[2]
                    # Vulnerable if version < 1.11.0
                    if ($minorVersion -lt 11 -or ($minorVersion -eq 11 -and $patchVersion -lt 0)) {
                        $vulnerableJars += $entry.Name
                    }
                }
                # Check for commons-lang3 3.0-3.17 (vulnerable)
                elseif ($entry.Name -match "commons-lang3-3\.(\d+)\.") {
                    $minorVersion = [int]$matches[1]
                    if ($minorVersion -le 17) {
                        $vulnerableJars += $entry.Name
                    }
                }
            }
        }
        
        $archive.Dispose()
        
        return @{
            HasVulnerableJars = ($vulnerableJars.Count -gt 0)
            VulnerableJars = $vulnerableJars
            WarFile = $warFile
        }
    }
    catch {
        return @{
            HasVulnerableJars = $false
            VulnerableJars = @()
            WarFile = $warFile
            Error = $_.Exception.Message
        }
    }
}

# Test for vulnerable JAR files in lib directory
function Test-VulnerableJars {
    param([string]$JarDirectory)
    
    # Check for commons-text 1.x versions (vulnerable if < 1.11.0)
    $textFiles = Get-ChildItem -Path $JarDirectory -Name "commons-text-1.*.jar" -ErrorAction SilentlyContinue
    if ($textFiles) {
        foreach ($file in $textFiles) {
            if ($file -match "commons-text-1\.(\d+)\.(\d+)") {
                $minorVersion = [int]$matches[1]
                $patchVersion = [int]$matches[2]
                # Vulnerable if version < 1.11.0
                if ($minorVersion -lt 11 -or ($minorVersion -eq 11 -and $patchVersion -lt 0)) {
                    return $true
                }
            }
        }
    }
    
    # Check for commons-lang3 3.0-3.17 (vulnerable)
    $langFiles = Get-ChildItem -Path $JarDirectory -Name "commons-lang3-3.*.jar" -ErrorAction SilentlyContinue
    if ($langFiles) {
        foreach ($file in $langFiles) {
            if ($file -match "commons-lang3-3\.(\d+)\.") {
                $minorVersion = [int]$matches[1]
                if ($minorVersion -le 17) {
                    return $true
                }
            }
        }
    }
    
    return $false
}

# Create backup of JAR files before replacement
function New-JarBackup {
    param(
        [string]$JarDirectory,
        [string]$BackupDirectory
    )
    
    Write-InfoMessage "Creating JAR backup" "Backing up existing JAR files to $BackupDirectory"
    
    # Create backup directory if it doesn't exist
    if (-not (Test-Path $BackupDirectory)) {
        New-Item -ItemType Directory -Path $BackupDirectory -Force | Out-Null
    }
    
    $backupCount = 0
    $errors = @()
    
    try {
        # Backup commons-text JARs
        $textJars = Get-ChildItem "$JarDirectory\commons-text-*.jar" -ErrorAction SilentlyContinue
        foreach ($jar in $textJars) {
            $backupPath = Join-Path $BackupDirectory $jar.Name
            try {
                Copy-Item $jar.FullName $backupPath -Force
                $backupCount++
                Write-Host "  Backed up: $($jar.Name)" -ForegroundColor Gray
            } catch {
                $errors += "Failed to backup $($jar.Name): $($_.Exception.Message)"
            }
        }
        
        # Backup commons-lang3 JARs
        $langJars = Get-ChildItem "$JarDirectory\commons-lang3-*.jar" -ErrorAction SilentlyContinue
        foreach ($jar in $langJars) {
            $backupPath = Join-Path $BackupDirectory $jar.Name
            try {
                Copy-Item $jar.FullName $backupPath -Force
                $backupCount++
                Write-Host "  Backed up: $($jar.Name)" -ForegroundColor Gray
            } catch {
                $errors += "Failed to backup $($jar.Name): $($_.Exception.Message)"
            }
        }
        
        if ($errors.Count -gt 0) {
            Write-Host "Backup completed with errors:" -ForegroundColor Yellow
            foreach ($error in $errors) {
                Write-Host "  $error" -ForegroundColor Yellow
            }
            return $false
        }
        
        Write-Host "Backup completed successfully: $backupCount file(s) backed up" -ForegroundColor Green
        Write-LogEntry "Backup completed: $backupCount files backed up to $BackupDirectory"
        return $true
        
    } catch {
        Write-Host "Backup failed: $($_.Exception.Message)" -ForegroundColor Red
        return $false
    }
}

# Download JAR files
function Get-SecureJarFiles {
    param([string]$DownloadDir)
    
    Write-InfoMessage "Downloading secure JAR files" "Downloading commons-text-$script:CommonsTextVersion.jar and commons-lang3-$script:CommonsLangVersion.jar"
    
    $baseUrl = "https://repo1.maven.org/maven2/org/apache/commons"
    $jars = @{
        "commons-text" = @{
            Version = $script:CommonsTextVersion
            Url = "$baseUrl/commons-text/$script:CommonsTextVersion/commons-text-$script:CommonsTextVersion.jar"
            LocalPath = "$DownloadDir\commons-text-$script:CommonsTextVersion.jar"
        }
        "commons-lang3" = @{
            Version = $script:CommonsLangVersion
            Url = "$baseUrl/commons-lang3/$script:CommonsLangVersion/commons-lang3-$script:CommonsLangVersion.jar"
            LocalPath = "$DownloadDir\commons-lang3-$script:CommonsLangVersion.jar"
        }
    }
    
    if (-not (Test-Path $DownloadDir)) {
        New-Item -ItemType Directory -Path $DownloadDir -Force | Out-Null
    }
    
    foreach ($jarName in $jars.Keys) {
        $jar = $jars[$jarName]
        Write-InfoMessage "Downloading $jarName JAR" "Version: $($jar.Version)"
        
        try {
            Invoke-WebRequest -Uri $jar.Url -OutFile $jar.LocalPath -TimeoutSec 300
            if (-not (Test-Path $jar.LocalPath)) {
                throw "Downloaded file not found"
            }
            Write-InfoMessage "Downloaded successfully" $jar.LocalPath
        }
        catch {
            Write-ErrorMessage "Failed to download $jarName JAR" $_.Exception.Message
            return $false
        }
    }
    
    return $jars
}

# Replace JAR files
function Update-JarFiles {
    param(
        [PSCustomObject]$Installation,
        [hashtable]$SecureJars
    )
    
    $jarDir = $Installation.JarDirectory
    $replacementCount = 0
    
    Write-InfoMessage "Processing installation" $Installation.InstallPath
    
    # Replace commons-text JARs
    $oldTextJars = Get-ChildItem -Path $jarDir -Name "commons-text-*.jar" -ErrorAction SilentlyContinue
    foreach ($oldJar in $oldTextJars) {
        $oldPath = "$jarDir\$oldJar"
        $newJarName = "commons-text-$script:CommonsTextVersion.jar"
        $newPath = "$jarDir\$newJarName"
        $sourcePath = $SecureJars["commons-text"].LocalPath
        
        Write-InfoMessage "Replacing JAR file" "$oldJar -> $newJarName"
        
        if (-not $DryRun) {
            try {
                # Remove old JAR file and install new one with correct name
                Remove-Item -Path $oldPath -Force
                Copy-Item -Path $sourcePath -Destination $newPath -Force
                $replacementCount++
            }
            catch {
                Write-ErrorMessage "Failed to replace $oldJar" $_.Exception.Message
                return $false
            }
        } else {
            $replacementCount++
        }
    }
    
    # Replace commons-lang3 JARs
    $oldLangJars = Get-ChildItem -Path $jarDir -Name "commons-lang3-*.jar" -ErrorAction SilentlyContinue
    foreach ($oldJar in $oldLangJars) {
        $oldPath = "$jarDir\$oldJar"
        $newJarName = "commons-lang3-$script:CommonsLangVersion.jar"
        $newPath = "$jarDir\$newJarName"
        $sourcePath = $SecureJars["commons-lang3"].LocalPath
        
        Write-InfoMessage "Replacing JAR file" "$oldJar -> $newJarName"
        
        if (-not $DryRun) {
            try {
                # Remove old JAR file and install new one with correct name
                Remove-Item -Path $oldPath -Force
                Copy-Item -Path $sourcePath -Destination $newPath -Force
                $replacementCount++
            }
            catch {
                Write-ErrorMessage "Failed to replace $oldJar" $_.Exception.Message
                return $false
            }
        } else {
            $replacementCount++
        }
    }
    
    Write-InfoMessage "JAR replacement completed" "Replaced $replacementCount file(s)"
    return $true
}

# Main execution
try {
    # Initialize logging
    $logDir = "$PSScriptRoot\logs"
    if (-not (Test-Path $logDir)) {
        New-Item -ItemType Directory -Path $logDir -Force | Out-Null
    }
    $logFile = "$logDir\jar_replacer_$(Get-Date -Format 'yyyyMMdd_HHmmss').log"
    
    # Function to write to log file
    function Write-LogEntry {
        param([string]$Message)
        $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
        "$timestamp - $Message" | Out-File -FilePath $logFile -Append -Encoding UTF8
    }
    
    Write-LogEntry "FileMaker JAR Replacer v$script:ScriptVersion started"
    
    Write-Host ""
    Write-Host "=================================================================" -ForegroundColor Cyan
    Write-Host " FileMaker Apache Commons JAR Replacer for Windows v$script:ScriptVersion" -ForegroundColor Cyan
    Write-Host " Addressing CVE-2025-46295 Vulnerability" -ForegroundColor Cyan
    Write-Host "=================================================================" -ForegroundColor Cyan
    Write-Host ""
    
    Write-InfoMessage "Log file created" $logFile
    
    if ($DryRun) {
        Write-WarningMessage "DRY RUN MODE" "No changes will be made to the system"
        Write-Host ""
    }
    
    # Check administrator privileges
    if (-not (Test-Administrator)) {
        Write-ErrorMessage "Administrator privileges required" "Please run this script as Administrator"
        exit 1
    }
    
    Write-InfoMessage "Administrator privileges confirmed"
    
    # Check PowerShell version
    $psVersion = $PSVersionTable.PSVersion
    Write-InfoMessage "PowerShell version" "$($psVersion.Major).$($psVersion.Minor).$($psVersion.Build)"
    
    if ($psVersion.Major -lt 5) {
        Write-ErrorMessage "PowerShell 5.0 or later required" "Current version: $psVersion"
        exit 1
    }
    
    # Find FileMaker installations
    Write-InfoMessage "Scanning for FileMaker Server installations"
    $installations = Get-FileMakerInstallations
    
    if (@($installations).Length -eq 0) {
        Write-ErrorMessage "No FileMaker Server installations found"
        Write-Host ""
        Write-Host "Expected locations:" -ForegroundColor Gray
        Write-Host "  - C:\Program Files\FileMaker\FileMaker Server" -ForegroundColor Gray
        Write-Host "  - C:\Program Files (x86)\FileMaker\FileMaker Server" -ForegroundColor Gray
        exit 1
    }
    
    Write-InfoMessage "Found $(@($installations).Length) FileMaker Server installation(s)"
    
    # Display detailed installation information
    foreach ($installation in $installations) {
        Write-Host ""
        Write-Host "FileMaker Server Installation:" -ForegroundColor Cyan
        Write-Host "  Path: $($installation.InstallPath)" -ForegroundColor Gray
        Write-Host "  Version: $($installation.Version)" -ForegroundColor Gray
        Write-Host "  JAR Directory: $($installation.JarDirectory)" -ForegroundColor Gray
        if ($installation.HasVulnerableJars) {
            Write-Host "  Vulnerable JARs in lib: $($installation.HasVulnerableJars)" -ForegroundColor Red
        } else {
            Write-Host "  Vulnerable JARs in lib: $($installation.HasVulnerableJars)" -ForegroundColor Green
        }
        
        # Check WAR file results
        if ($installation.WarCheck) {
            if ($installation.WarCheck.HasVulnerableJars) {
                Write-Host "  Vulnerable JARs in WAR: $($installation.WarCheck.HasVulnerableJars)" -ForegroundColor Yellow
                Write-Host "  WAR File: $($installation.WarCheck.WarFile)" -ForegroundColor Gray
                if ($installation.WarCheck.VulnerableJars.Count -gt 0) {
                    Write-Host "  Vulnerable JARs found in WAR:" -ForegroundColor Yellow
                    foreach ($jarFile in $installation.WarCheck.VulnerableJars) {
                        Write-Host "    - $jarFile" -ForegroundColor Yellow
                    }
                }
            } else {
                Write-Host "  Vulnerable JARs in WAR: False" -ForegroundColor Green
            }
        }
    }
    
    # Check vulnerability status and deployment scenarios
    $vulnerableInstallations = $installations | Where-Object { $_.HasVulnerableJars }
    $warVulnerableInstallations = $installations | Where-Object { $_.WarCheck -and $_.WarCheck.HasVulnerableJars }
    
    # Analyze deployment scenarios for each installation
    $wpeDeployedSecureCount = 0
    $wpeDeployedVulnerableCount = 0
    $wpeNeverEnabledCount = 0
    $warVulnerableJars = @()
    
    foreach ($installation in $installations) {
        $libDirectoryExists = Test-Path $installation.JarDirectory
        
        if ($libDirectoryExists) {
            # WPE is deployed - check if JARs are vulnerable or secure
            if ($installation.HasVulnerableJars) {
                # WPE deployed with vulnerable JARs
                $wpeDeployedVulnerableCount++
            } else {
                # WPE deployed with secure JARs
                $wpeDeployedSecureCount++
            }
        } else {
            # WPE has never been enabled (JAR directory doesn't exist)
            if ($installation.WarCheck -and $installation.WarCheck.HasVulnerableJars) {
                $wpeNeverEnabledCount++
                $warVulnerableJars += $installation.WarCheck.VulnerableJars
            }
        }
    }
    
    # Determine overall status based on deployment scenarios
    if ($wpeDeployedVulnerableCount -gt 0) {
        # Scenario 2: WPE deployed with vulnerable JARs - VULNERABLE
        # Continue with normal vulnerable installation processing
    } elseif ($wpeNeverEnabledCount -gt 0) {
        # Scenario 1: WPE not deployed but vulnerable JARs in WAR - POTENTIALLY VULNERABLE
        Write-Host ""
        Write-Host "===============================================================" -ForegroundColor DarkGray
        Write-Host " OPERATION COMPLETED" -ForegroundColor Gray
        Write-Host ""
        Write-Host " Potential vulnerability detected in WAR files" -ForegroundColor White
        Write-Host " installations_checked: $(@($installations).Length), vulnerable_count: 0, war_vulnerable_count: $wpeNeverEnabledCount" -ForegroundColor Gray
        Write-Host "===============================================================" -ForegroundColor DarkGray
        
        # Show final vulnerability status
        Show-FinalVulnerabilityStatus -VulnerableCount 0 -WarVulnerableCount $wpeNeverEnabledCount -Mode "live"
        
        Write-Host "CVE-2025-46295 Status: POTENTIALLY VULNERABLE" -ForegroundColor Yellow
        Write-Host ""
        Write-Host "IMPORTANT:" -ForegroundColor Yellow
        Write-Host "The Web Publishing Engine has never been enabled on this server." -ForegroundColor Yellow
        Write-Host "However, vulnerable JAR files exist in the WAR archive. If you enable" -ForegroundColor Yellow
        Write-Host "the Web Publishing Engine, these vulnerable JARs will be deployed and" -ForegroundColor Yellow
        Write-Host "your server will become vulnerable to CVE-2025-46295." -ForegroundColor Yellow
        Write-Host ""
        Write-Host "RECOMMENDATION:" -ForegroundColor White
        Write-Host "Update FileMaker Server to a version that includes the security fixes before" -ForegroundColor Gray
        Write-Host "enabling the Web Publishing Engine, or contact Claris support for guidance." -ForegroundColor Gray
        Write-Host ""
        Write-Host "Vulnerable JAR files found in WAR archives:" -ForegroundColor Yellow
        foreach ($jarFile in $warVulnerableJars) {
            Write-Host "  - $jarFile" -ForegroundColor Yellow
        }
        Write-Host ""
        Write-Host "Documentation:" -ForegroundColor Cyan
        Write-Host "  - CVE-2025-46295 Details: https://nvd.nist.gov/vuln/detail/CVE-2025-46295" -ForegroundColor Blue
        Write-Host "  - Claris Security Advisory: https://support.claris.com/s/answerview?anum=000049055`&language=en_US" -ForegroundColor Blue
        Write-Host ""
        exit 0
    } elseif ($wpeDeployedSecureCount -gt 0) {
        # Scenario 3: WPE deployed with secure JARs - SECURE
        Write-InfoMessage "All installations are secure" "Web Publishing Engine is deployed and all JAR files are already patched against CVE-2025-46295"
        Write-Host ""
        Write-Host "===============================================================" -ForegroundColor DarkGray
        Write-Host " OPERATION COMPLETED SUCCESSFULLY" -ForegroundColor Green
        Write-Host ""
        Write-Host " All installations are secure (no update needed)" -ForegroundColor White
        Write-Host " installations_checked: $(@($installations).Length), vulnerable_count: 0, secure_deployed_count: $wpeDeployedSecureCount" -ForegroundColor Gray
        Write-Host "===============================================================" -ForegroundColor DarkGray
        
        # Show final vulnerability status
        Show-FinalVulnerabilityStatus -VulnerableCount 0 -WarVulnerableCount 0 -Mode "live"
        
        Write-Host "Security Status: SECURE" -ForegroundColor Green
        Write-Host "  Web Publishing Engine is deployed and all JAR files are already patched against CVE-2025-46295" -ForegroundColor Green
        Write-Host "  The deployed JAR files in the lib directory are secure versions" -ForegroundColor Green
        Write-Host ""
        Write-Host "Documentation:" -ForegroundColor Cyan
        Write-Host "  - CVE-2025-46295 Details: https://nvd.nist.gov/vuln/detail/CVE-2025-46295" -ForegroundColor Blue
        Write-Host "  - Claris Security Advisory: https://support.claris.com/s/answerview?anum=000049055`&language=en_US" -ForegroundColor Blue
        Write-Host "  - FileMaker Server Update Guide: https://support.claris.com/s/answerview?anum=000049059`&language=en_US" -ForegroundColor Blue
        Write-Host ""
        exit 0
    } else {
        # No installations found or no vulnerabilities detected
        Write-Host ""
        Write-Host "===============================================================" -ForegroundColor DarkGray
        Write-Host " OPERATION COMPLETED" -ForegroundColor Gray
        Write-Host ""
        Write-Host " No vulnerabilities detected" -ForegroundColor White
        Write-Host " installations_checked: $(@($installations).Length), vulnerable_count: 0" -ForegroundColor Gray
        Write-Host "===============================================================" -ForegroundColor DarkGray
        
        # Show final vulnerability status
        Show-FinalVulnerabilityStatus -VulnerableCount 0 -WarVulnerableCount 0 -Mode "live"
        exit 0
    }
    
    if ($vulnerableInstallations.Count -eq 0 -and $wpeNeverEnabledCount -gt 0) {
        Write-Host "===============================================================" -ForegroundColor DarkGray
        
        # Show final vulnerability status
        Show-FinalVulnerabilityStatus -VulnerableCount 0 -WarVulnerableCount 0 -Mode "live"
        
        Write-Host "Documentation:" -ForegroundColor Cyan
        Write-Host "  - CVE-2025-46295 Details: https://nvd.nist.gov/vuln/detail/CVE-2025-46295" -ForegroundColor Blue
        Write-Host "  - Claris Security Advisory: https://support.claris.com/s/answerview?anum=000049055`&language=en_US" -ForegroundColor Blue
        Write-Host ""
        exit 0
    }
    
    if ($vulnerableInstallations.Count -eq 0 -and $warVulnerableInstallations.Count -gt 0) {
        Write-WarningMessage "POTENTIAL VULNERABILITY DETECTED" "Vulnerable JAR files found in WAR archives but not currently deployed"
        Write-Host ""
        Write-Host "===============================================================" -ForegroundColor DarkGray
        Write-Host " OPERATION COMPLETED" -ForegroundColor Gray
        Write-Host ""
        Write-Host " Potential vulnerability detected in WAR files" -ForegroundColor White
        Write-Host " installations_checked: $(@($installations).Length), vulnerable_count: 0, war_vulnerable_count: $($warVulnerableInstallations.Count)" -ForegroundColor Gray
        Write-Host "===============================================================" -ForegroundColor DarkGray
        
        # Show final vulnerability status
        Show-FinalVulnerabilityStatus -VulnerableCount 0 -WarVulnerableCount $warVulnerableInstallations.Count -Mode "live"
        
        Write-Host "CVE-2025-46295 Status: POTENTIALLY VULNERABLE" -ForegroundColor Yellow
        Write-Host ""
        Write-Host "IMPORTANT:" -ForegroundColor Yellow
        Write-Host "The Web Publishing Engine has never been enabled on this server." -ForegroundColor Yellow
        Write-Host "However, if you enable the Web Publishing Engine in the future, vulnerable JAR files" -ForegroundColor Yellow
        Write-Host "will be deployed and your server will become vulnerable to CVE-2025-46295." -ForegroundColor Yellow
        Write-Host ""
        Write-Host "RECOMMENDATION:" -ForegroundColor White
        Write-Host "Update FileMaker Server to a version that includes the security fixes before" -ForegroundColor Gray
        Write-Host "enabling the Web Publishing Engine, or contact Claris support for guidance." -ForegroundColor Gray
        Write-Host ""
        Write-Host "Vulnerable JAR files found in WAR archives:" -ForegroundColor Yellow
        foreach ($jarFile in $warVulnerableJars) {
            Write-Host "  - $jarFile" -ForegroundColor Yellow
        }
        Write-Host ""
        Write-Host "Documentation:" -ForegroundColor Cyan
        Write-Host "  - CVE-2025-46295 Details: https://nvd.nist.gov/vuln/detail/CVE-2025-46295" -ForegroundColor Blue
        Write-Host "  - Claris Security Advisory: https://support.claris.com/s/answerview?anum=000049055`&language=en_US" -ForegroundColor Blue
        Write-Host ""
        exit 0
    }
    
    Write-Host ""
    Write-Host "CVE-2025-46295 VULNERABILITY DETECTED" -ForegroundColor Red
    Write-Host "  Installation requires JAR file patching" -ForegroundColor Red
    Write-Host ""
    
    # Show vulnerable JAR files
    $vulnerableJarFiles = @()
    foreach ($installation in $vulnerableInstallations) {
        if ($installation.VulnerableJars) {
            if ($installation.VulnerableJars -is [array]) {
                $vulnerableJarFiles += $installation.VulnerableJars
            } else {
                $vulnerableJarFiles += @($installation.VulnerableJars)
            }
        }
    }
    
    if ($vulnerableJarFiles.Count -gt 0) {
        Write-Host ""
        Write-Host "Vulnerable JAR Files Found:" -ForegroundColor Yellow
        foreach ($jarFile in $vulnerableJarFiles) {
            Write-Host "  - $jarFile" -ForegroundColor Gray
        }
        Write-Host ""
    }
    
    if ($DryRun) {
        Write-Host "DRY RUN COMPLETE - NO CHANGES MADE" -ForegroundColor Cyan
        Write-Host ""
        Write-Host "Summary of what would be performed:" -ForegroundColor White
        Write-Host "  1. Download secure JAR files (commons-text-$script:CommonsTextVersion.jar, commons-lang3-$script:CommonsLangVersion.jar)" -ForegroundColor Gray
        Write-Host "  2. Replace vulnerable JAR files with secure versions" -ForegroundColor Gray
        Write-Host "  3. Verify JAR replacement" -ForegroundColor Gray
        Write-Host ""
        Write-Host "Vulnerable JAR files that would be replaced:" -ForegroundColor White
        foreach ($jarFile in $vulnerableJarFiles) {
            Write-Host "  - $jarFile" -ForegroundColor Gray
        }
        Write-Host ""
        Write-Host "To apply these changes, run the script without -DryRun" -ForegroundColor Yellow
        
        # Show operation summary with de-emphasized completion
        Write-Host ""
        Write-Host "===============================================================" -ForegroundColor DarkGray
        Write-Host " OPERATION COMPLETED" -ForegroundColor Gray
        Write-Host ""
        Write-Host " Dry run completed - no changes were made" -ForegroundColor White
        Write-Host " installations_checked: $(@($installations).Length), vulnerable_count: $(@($vulnerableInstallations).Length), mode: dry_run" -ForegroundColor Gray
        Write-Host "===============================================================" -ForegroundColor DarkGray
        
        # Show final vulnerability status
        Show-FinalVulnerabilityStatus -VulnerableCount @($vulnerableInstallations).Length -WarVulnerableCount @($warVulnerableInstallations).Length -Mode "dry_run"
        
        exit 0
    }
    
    # Download secure JAR files
    Write-InfoMessage "Downloading secure JAR files"
    $downloadDir = "$PSScriptRoot\downloads"
    $secureJars = Get-SecureJarFiles -DownloadDir $downloadDir
    
    if (-not $secureJars) {
        Write-ErrorMessage "Failed to download secure JAR files"
        exit 1
    }
    
    # Create backups before replacing JAR files
    Write-InfoMessage "Creating backups" "Backing up existing JAR files before replacement"
    Write-LogEntry "Starting backup creation for $(@($vulnerableInstallations).Length) vulnerable installations"
    $backupDir = "$PSScriptRoot\backups\filemaker_backup_$(Get-Date -Format 'yyyyMMdd_HHmmss')"
    
    # Ensure backups directory exists
    $backupsRoot = "$PSScriptRoot\backups"
    if (-not (Test-Path $backupsRoot)) {
        New-Item -ItemType Directory -Path $backupsRoot -Force | Out-Null
        Write-LogEntry "Created backups directory: $backupsRoot"
    }
    
    Write-InfoMessage "Backup location" $backupDir
    $backupSuccess = $true
    
    foreach ($installation in $vulnerableInstallations) {
        $installBackupDir = "$backupDir\$(Split-Path $installation.InstallPath -Leaf)"
        Write-LogEntry "Creating backup for installation: $($installation.InstallPath)"
        if (-not (New-JarBackup -JarDirectory $installation.JarDirectory -BackupDirectory $installBackupDir)) {
            $backupSuccess = $false
            Write-ErrorMessage "Backup failed for installation" $installation.InstallPath
            Write-LogEntry "ERROR: Backup failed for installation: $($installation.InstallPath)"
        }
    }
    
    if (-not $backupSuccess) {
        Write-ErrorMessage "Backup creation failed" "Cannot proceed without successful backup"
        Write-LogEntry "ERROR: Backup creation failed, exiting"
        exit 1
    }
    
    Write-InfoMessage "Backup completed" "JAR files backed up to: $backupDir"
    Write-LogEntry "Backup completed successfully to: $backupDir"
    
    # Replace JAR files in each vulnerable installation
    $successCount = 0
    foreach ($installation in $vulnerableInstallations) {
        Write-LogEntry "Starting JAR replacement for installation: $($installation.InstallPath)"
        $result = Update-JarFiles -Installation $installation -SecureJars $secureJars
        Write-LogEntry "JAR replacement result for $($installation.InstallPath): $result"
        if ($result) {
            $successCount++
            Write-LogEntry "Successfully updated installation: $($installation.InstallPath)"
        } else {
            Write-LogEntry "ERROR: Failed to update installation: $($installation.InstallPath)"
        }
    }
    
    # Cleanup downloaded files
    if (Test-Path $downloadDir) {
        Remove-Item -Path $downloadDir -Recurse -Force -ErrorAction SilentlyContinue
    }
    
    # Final status
    Write-Host ""
    Write-Host "===============================================================" -ForegroundColor DarkGray
    if ($successCount -eq @($vulnerableInstallations).Length) {
        # De-emphasize success when vulnerabilities were found and fixed
        Write-Host " OPERATION COMPLETED" -ForegroundColor Gray
        Write-Host ""
        Write-Host " JAR replacement completed successfully" -ForegroundColor White
        Write-Host " installations_processed: $(@($vulnerableInstallations).Length), vulnerable_count: $(@($vulnerableInstallations).Length), fixed_count: $successCount" -ForegroundColor Gray
        Write-Host "===============================================================" -ForegroundColor DarkGray
        
        # Restart Web Publishing Engine to load new JAR files
        Write-InfoMessage "Restarting Web Publishing Engine" "Loading updated JAR files"
        try {
            $restartResult = fmsadmin restart wpe -y 2>&1
            if ($LASTEXITCODE -eq 0) {
                Write-Host "Web Publishing Engine Restarted: Updated JAR files are now active" -ForegroundColor Green
                Write-LogEntry "WPE restart successful"
            } else {
                Write-Host "WPE Restart Failed: Manual restart required" -ForegroundColor Red
                Write-Host "Run this command manually: fmsadmin restart wpe -y" -ForegroundColor Yellow
                Write-LogEntry "WPE restart failed with exit code: $LASTEXITCODE"
                if ($restartResult -and $restartResult.ToString().Trim()) {
                    Write-Host "Error details: $($restartResult.ToString().Trim())" -ForegroundColor Red
                }
            }
        } catch {
            Write-Host "WPE Restart Failed: Manual restart required" -ForegroundColor Red
            Write-Host "Run this command manually: fmsadmin restart wpe -y" -ForegroundColor Yellow
            Write-Host "Error: $($_.Exception.Message)" -ForegroundColor Red
            Write-LogEntry "WPE restart exception: $($_.Exception.Message)"
        }
        
        # Show final vulnerability status
        Show-FinalVulnerabilityStatus -VulnerableCount 0 -WarVulnerableCount $warVulnerableInstallations.Count -Mode "live"
        
        Write-Host "CVE-2025-46295 Status: RESOLVED" -ForegroundColor Green
        Write-Host "Commons Text Version: $script:CommonsTextVersion" -ForegroundColor Gray
        Write-Host "Commons Lang Version: $script:CommonsLangVersion" -ForegroundColor Gray
        Write-Host ""
        Write-Host "Documentation:" -ForegroundColor Cyan
        Write-Host "  - CVE-2025-46295 Details: https://nvd.nist.gov/vuln/detail/CVE-2025-46295" -ForegroundColor Blue
        Write-Host "  - Claris Security Advisory: https://support.claris.com/s/answerview?anum=000049055`&language=en_US" -ForegroundColor Blue
        Write-Host ""
        exit 0
    } else {
        Write-Host " OPERATION FAILED" -ForegroundColor Red
        Write-Host ""
        Write-Host " JAR replacement failed or incomplete" -ForegroundColor White
        Write-Host " Successfully updated: $successCount/$(@($vulnerableInstallations).Length) installations" -ForegroundColor Gray
        Write-Host ""
        Write-Host " Failed installations:" -ForegroundColor Red
        $failedCount = 0
        foreach ($installation in $vulnerableInstallations) {
            # Check if this installation was successfully updated
            $wasSuccessful = $false
            # This is a simplified check - in a real implementation, you'd track which ones succeeded
            if ($failedCount -lt (@($vulnerableInstallations).Length - $successCount)) {
                Write-Host "   - $($installation.InstallPath)" -ForegroundColor Red
                Write-LogEntry "Failed installation: $($installation.InstallPath)"
                $failedCount++
            }
        }
        Write-Host "===============================================================" -ForegroundColor DarkGray
        
        Write-LogEntry "Operation failed: $successCount/$(@($vulnerableInstallations).Length) installations updated successfully"
        
        # Show final vulnerability status (still vulnerable)
        Show-FinalVulnerabilityStatus -VulnerableCount (@($vulnerableInstallations).Length - $successCount) -WarVulnerableCount $wpeNeverEnabledCount -Mode "live"
        
        exit 1
    }
    
    exit 0
}
catch {
    Write-ErrorMessage "Unexpected error occurred" $_.Exception.Message
    Write-Host "Stack trace:" -ForegroundColor Gray
    Write-Host $_.Exception.StackTrace -ForegroundColor DarkGray
    exit 1
}