* [Blog](https://www.paloaltonetworks.com.au/blog) * [Palo Alto Networks](https://www.paloaltonetworks.com.au/blog/corporate/) * [未分类](https://www.paloaltonetworks.com.au/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant) * 威胁简报：高危 Apache Struts 漏洞 ... # 威胁简报：高危 Apache Struts 漏洞 CVE-2018-11776 的相关信息 [](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.paloaltonetworks.com.au%2Fblog%2F2018%2F10%2F%25e5%25a8%2581%25e8%2583%2581%25e7%25ae%2580%25e6%258a%25a5%25ef%25bc%259a%25e9%25ab%2598%25e5%258d%25b1-apache-struts-%25e6%25bc%258f%25e6%25b4%259e-cve-2018-11776-%25e7%259a%2584%25e7%259b%25b8%25e5%2585%25b3%25e4%25bf%25a1%25e6%2581%25af%2F%3Flang%3Dzh-hans) [](https://twitter.com/share?text=%E5%A8%81%E8%83%81%E7%AE%80%E6%8A%A5%EF%BC%9A%E9%AB%98%E5%8D%B1+Apache+Struts+%E6%BC%8F%E6%B4%9E+CVE-2018-11776+%E7%9A%84%E7%9B%B8%E5%85%B3%E4%BF%A1%E6%81%AF&url=https%3A%2F%2Fwww.paloaltonetworks.com.au%2Fblog%2F2018%2F10%2F%25e5%25a8%2581%25e8%2583%2581%25e7%25ae%2580%25e6%258a%25a5%25ef%25bc%259a%25e9%25ab%2598%25e5%258d%25b1-apache-struts-%25e6%25bc%258f%25e6%25b4%259e-cve-2018-11776-%25e7%259a%2584%25e7%259b%25b8%25e5%2585%25b3%25e4%25bf%25a1%25e6%2581%25af%2F%3Flang%3Dzh-hans) [](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.paloaltonetworks.com.au%2Fblog%2F2018%2F10%2F%25e5%25a8%2581%25e8%2583%2581%25e7%25ae%2580%25e6%258a%25a5%25ef%25bc%259a%25e9%25ab%2598%25e5%258d%25b1-apache-struts-%25e6%25bc%258f%25e6%25b4%259e-cve-2018-11776-%25e7%259a%2584%25e7%259b%25b8%25e5%2585%25b3%25e4%25bf%25a1%25e6%2581%25af%2F%3Flang%3Dzh-hans&title=%E5%A8%81%E8%83%81%E7%AE%80%E6%8A%A5%EF%BC%9A%E9%AB%98%E5%8D%B1+Apache+Struts+%E6%BC%8F%E6%B4%9E+CVE-2018-11776+%E7%9A%84%E7%9B%B8%E5%85%B3%E4%BF%A1%E6%81%AF&summary=&source=) [](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https://www.paloaltonetworks.com.au/blog/2018/10/%e5%a8%81%e8%83%81%e7%ae%80%e6%8a%a5%ef%bc%9a%e9%ab%98%e5%8d%b1-apache-struts-%e6%bc%8f%e6%b4%9e-cve-2018-11776-%e7%9a%84%e7%9b%b8%e5%85%b3%e4%bf%a1%e6%81%af/?lang=zh-hans&ts=markdown) \[\](mailto:?subject=威胁简报：高危 Apache Struts 漏洞 CVE-2018-11776 的相关信息) Link copied By [Christopher Budd](https://www.paloaltonetworks.com/blog/author/christopher-budd/?lang=zh-hans&ts=markdown "Posts by Christopher Budd") Oct 03, 2018 1 minutes [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) **情况概述** 2018 年 8 月 22 日，Apache Foundation ++[发布](https://cwiki.apache.org/confluence/display/WW/S2-057)++ 了针对 ++[CVE-2018-1176](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11776)++ 的重要安全更新，这个远程代码执行漏洞存在于 2.3 到 2.3.34，以及 2.5 到 2.5.16 版本的 Apache Struts 中。Apache Foundation 已敦促大家尽快应用此安全更新。 本博客文章旨在提供信息来帮助组织评估其漏洞风险，并向 Palo Alto Networks 客户提供保护措施，助其在应用安全更新之前降低风险。已部署 2018 年 8 月 24 日发布的最新漏洞签名的 Palo Alto Networks 客户将受到保护。 **漏洞信息** 根据 Apache Foundation 和安全研究员 ++[Man Yue Mo](https://semmle.com/news/apache-struts-CVE-2018-11776#was-i-vulnerable)++ 所述，该漏洞可以在运行易受攻击的 Apache Struts 版本的服务器上实现远程代码执行。该方法通过向易受攻击的系统发送特制 URL 进行攻击。在大多数情况下，这意味着利用该漏洞无需进行身份验证。 如攻击成功，便可在 Struts 使用的安全情境中运行代码。在某些情况下，这会导致系统受到全面入侵。 但是，请特别注意，如果使用默认配置则无法利用该漏洞。只有满足以下两个条件的系统才容易受到攻击： * 将 Struts 配置中的 [alwaysSelectFullNamespace](https://stackoverflow.com/questions/17690956/how-to-prevent-the-wildcard-namespace-in-struts#17697478) 标记设置为"true"。（注意：如果您的应用使用热门的 ++[Struts Convention 插件](https://struts.apache.org/plugins/convention/)++，则该插件会将此项默认设置为"true"。 * Struts 应用使用未指定命名空间或通过包含通配符的命名空间而配置的"操作"。此条件适用于在 Struts 配置文件中指定的操作和命名空间。注意：如果您的应用使用流行的 Struts Convention 插件，此条件也适用于在 Java 代码中指定的操作和命名空间。 即使 Struts 应用不满足这两个条件，您的应用也可能容易受到攻击，但就目前而言不会通过 CVE-2018-11776 遭到漏洞利用。 特别是，如果您的应用使用热门的 Struts Convention 插件，则与其他不使用该插件的 Struts 实施相比，您遭到漏洞利用的风险可能会更高。 **威胁环境信息** 在 8 月 22 日，已同时公开了该漏洞和用于解决该漏洞的安全更新。其中包含有关该漏洞以及目前如何利用该漏洞的详细信息。还提供了可用的概念验证 (PoC) 代码。如上所述，该 PoC 仅适用于易受攻击且满足可被利用条件的系统。 有些人已经注意到，在去年发布安全更新和漏洞信息仅三天后，就发生了一起 Struts 漏洞被主动攻击的严重事件。 目前没有已知的主动攻击，且存在两个要实现漏洞利用必须满足的非默认条件，因此当前的威胁环境有所不同。 然而，通过可用的主动 PoC 所进行的一些基本测试，我们仍认为在短期可能会出现针对该漏洞的主动利用。 在解决下面四个问题之前，组织需要将针对可能发生的攻击进行严格的风险评估： 1. 是否在使用 Struts Convention 插件？ 2. 是否同时满足漏洞利用所需的两个条件？ 3. 是否存在将目前的 PoC 进行改造或用于攻击的迹象？ 4. 开发出的新 PoC 或攻击是否不再需要漏洞利用所需的两个条件？ **适用于 Palo Alto Networks 客户的指导建议和保护措施** 运行易受攻击的 Apache Struts 版本的所有组织应尽快部署此安全更新。 组织可以并且应该根据安全策略和风险评估以及当前可用信息来优先安排和部署此安全更新。 已部署 2018 年 8 月 24 日发布的内容发行版本 8057（包括 ID 33948，名称：Apache Struts 2 Remote Code Execution Vulnerability）中的漏洞签名的 Palo Alto Networks 客户，可有效防御已知的针对该漏洞的漏洞利用。 客户仍应按照上面的建议部署此安全更新，但可以而且应该立即部署最新的漏洞签名以获得更多保护。对于这些附加的保护措施，我们的客户可以并应该在进行安全决策、安全更新部署以及漏洞和威胁环境的风险评估时将其纳入考量。 与往常一样，我们会密切监控情况，并适时提供更多详细信息。 *** ** * ** *** ## Related Blogs ### [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [#### AI代理已經來臨，威脅也隨之而來](https://www.paloaltonetworks.com.au/blog/2025/05/ai-agents-threats/?lang=zh-hant) ### [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [#### Strata Copilot - 加速迈向自主网络安全的未来](https://www.paloaltonetworks.com.au/blog/network-security/strata-copilot/?lang=zh-hans) ### [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [#### 防火墙已死？至少本世纪不会！](https://www.paloaltonetworks.com.au/blog/2023/08/ngfw-is-not-dead-yet/?lang=zh-hans) ### [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [#### 面对性命攸关的时刻，如何实现可靠的医疗物联网安全](https://www.paloaltonetworks.com.au/blog/2022/12/medical-iot-security-to-depend-on/?lang=zh-hans) ### [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [#### 利用业界首创的 AIOps for NGFW 革新防火墙运行](https://www.paloaltonetworks.com.au/blog/2022/03/industry-first-aiops-for-ngfw/?lang=zh-hans) ### [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [#### Prisma Access 是保护远程用户安全的领先云服务](https://www.paloaltonetworks.com.au/blog/2021/08/prisma-access-leading-cloud-service-secure-remote-users/?lang=zh-hans) ### Subscribe to the Blog! Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more. ![spinner](https://www.paloaltonetworks.com.au/blog/wp-content/themes/panwblog2023/dist/images/ajax-loader.gif) Sign up Please enter a valid email. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) and acknowledge our [Privacy Statement](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown). Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder. This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. {#footer} {#footer} ## Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [Secure AI by Design](https://www.paloaltonetworks.com/precision-ai-security/secure-ai-by-design?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess?ts=markdown) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) * [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform?ts=markdown) * [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners?ts=markdown) ## Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Customers](https://www.paloaltonetworks.com/customers?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) ## Popular Links * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown) * [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![PAN logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) * [Documents](https://www.paloaltonetworks.com/legal?ts=markdown) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language