<# .SYNOPSIS Mitigation for CVE-2024-31982 in XWiki. .DESCRIPTION This script applies a durable, container-level workaround for CVE-2024-31982: - Creates a timestamped backup of WEB-INF\web.xml. - Inserts a denying access to /bin/*/Main/DatabaseSearch* and /bin/view/Main/DatabaseSearch*. - Optionally restarts the XWiki/Tomcat/Jetty service (disabled by default). - Verifies that the constraint is present, prints status, and exits (no background activity). The mitigation survives service/host restarts and does not modify application code. The definitive fix remains upgrading to a patched XWiki version. REQUIREMENTS: - PowerShell: 5.1+ or 7.x - OS: Windows 10/11, Windows Server 2016+ - Modules: Microsoft.PowerShell.Management (built-in) - Permissions: Ability to write to WEB-INF\web.xml (run elevated if needed) WARNINGS: - May require a service restart to take effect depending on your servlet container. - Always test in a lab first. Keep the backup to allow quick rollback. - If your XWiki path differs, update $XWikiWebappRoot accordingly. DISCLAIMER: VICARIUS STRONGLY RECOMMENDS RUNNING THESE SCRIPTS IN A TEST LAB ENVIRONMENT BEFORE DEPLOYING THEM TO PRODUCTION. USE AT YOUR OWN DISCRETION ONLY AFTER CAREFULLY ANALYZING THE SCRIPT. .AUTHOR This script has been made by Vicarius Research Team .VERSION 1.0 #> Set-StrictMode -Version Latest $ErrorActionPreference = 'Stop' function info { param([string]$m) Write-Host "[i] $m" } function good { param([string]$m) Write-Host "[+] $m" -ForegroundColor Green } function warn { param([string]$m) Write-Host "[!] $m" -ForegroundColor Yellow } function bad { param([string]$m) Write-Host "[-] $m" -ForegroundColor Red } $XWikiWebappRoot = 'C:\xwiki\webapps\xwiki' $RestartService = $false $ServiceName = '' function Get-WebXmlPath { param([string]$Root) Join-Path $Root 'WEB-INF\web.xml' } function Ensure-Backup { param([string]$FilePath) $stamp = (Get-Date).ToString('yyyyMMdd-HHmmss') $bak = "$FilePath.bak.$stamp" Copy-Item -Path $FilePath -Destination $bak -Force info ("Backup created: {0}" -f $bak) $bak } function Insert-Constraint { param([string]$WebXmlPath) $raw = Get-Content $WebXmlPath -Raw if ($raw -match '(?is).*Main/DatabaseSearch.*') { warn "Constraint already present. No change needed." return $false } $constraint = @"

Block CVE-2024-31982 DatabaseSearch

/bin/*/Main/DatabaseSearch/*

/bin/*/Main/DatabaseSearch

/bin/view/Main/DatabaseSearch*

"@ if ($raw -notmatch '') { throw ("Closing not found in {0}" -f $WebXmlPath) } $updated = $raw -replace '(?is)', ($constraint + "`r`n") Set-Content -Path $WebXmlPath -Value $updated -Encoding UTF8 $true } function Try-RestartService { param([string]$ExplicitName,[bool]$Enabled) if (-not $Enabled) { return } if ($ExplicitName) { try { info ("Restarting: {0}" -f $ExplicitName) Restart-Service -Name $ExplicitName -Force -ErrorAction Stop good ("Service restarted: {0}" -f $ExplicitName) return } catch { warn ("Could not restart {0}: {1}" -f $ExplicitName, $_.Exception.Message) return } } try { $candidates = Get-CimInstance Win32_Service | Where-Object { $_.State -eq 'Running' -and $_.Name -match '(?i)tomcat|jetty|xwiki' } if ($candidates.Count -eq 1) { $name = $candidates[0].Name info ("Restarting detected service: {0}" -f $name) Restart-Service -Name $name -Force -ErrorAction Stop good ("Service restarted: {0}" -f $name) } elseif ($candidates.Count -eq 0) { warn "No running Tomcat/Jetty/XWiki services detected; restart manually to apply changes." } else { warn "Multiple candidate services detected; restart manually to apply changes." } } catch { warn ("Service restart attempt failed: {0}" -f $_.Exception.Message) } } try { if (-not (Test-Path $XWikiWebappRoot)) { bad ("Webapp root not found: {0}" -f $XWikiWebappRoot); return } $webXml = Get-WebXmlPath -Root $XWikiWebappRoot if (-not (Test-Path $webXml)) { bad ("web.xml not found at: {0}" -f $webXml); return } info ("XWiki webapp: {0}" -f $XWikiWebappRoot) $bak = Ensure-Backup -FilePath $webXml $changed = Insert-Constraint -WebXmlPath $webXml if ($changed) { good "Mitigation block inserted into web.xml" } else { info "No changes performed (already present)." } Try-RestartService -ExplicitName $ServiceName -Enabled $RestartService $verify = Get-Content $webXml -Raw if ($verify -match '(?is).*Main/DatabaseSearch.*') { good "Mitigation IS applied (web.xml contains DatabaseSearch security-constraint)." } else { bad "Mitigation NOT applied; check web.xml (see backup)." } } catch { bad ("Error: {0}" -f $_.Exception.Message) }

PoC video

Description