* [Blog](https://origin-researchcenter.paloaltonetworks.com/blog) * [Palo Alto Networks](https://origin-researchcenter.paloaltonetworks.com/blog/corporate/) * [未分類](https://origin-researchcenter.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e9%a1%9e/?lang=fr) * 威脅簡報：有關重要 Apache Struts 弱... # 威脅簡報：有關重要 Apache Struts 弱點 CVE-2018-11776 的資訊 [](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Forigin-researchcenter.paloaltonetworks.com%2Fblog%2F2018%2F10%2Funit42-threat-brief-information-on-critical-apache-struts-vulnerability-cve-2018-11776%2F%3Flang%3Dzh-hant) [](https://twitter.com/share?text=%E5%A8%81%E8%84%85%E7%B0%A1%E5%A0%B1%EF%BC%9A%E6%9C%89%E9%97%9C%E9%87%8D%E8%A6%81+Apache+Struts+%E5%BC%B1%E9%BB%9E+CVE-2018-11776+%E7%9A%84%E8%B3%87%E8%A8%8A&url=https%3A%2F%2Forigin-researchcenter.paloaltonetworks.com%2Fblog%2F2018%2F10%2Funit42-threat-brief-information-on-critical-apache-struts-vulnerability-cve-2018-11776%2F%3Flang%3Dzh-hant) [](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Forigin-researchcenter.paloaltonetworks.com%2Fblog%2F2018%2F10%2Funit42-threat-brief-information-on-critical-apache-struts-vulnerability-cve-2018-11776%2F%3Flang%3Dzh-hant&title=%E5%A8%81%E8%84%85%E7%B0%A1%E5%A0%B1%EF%BC%9A%E6%9C%89%E9%97%9C%E9%87%8D%E8%A6%81+Apache+Struts+%E5%BC%B1%E9%BB%9E+CVE-2018-11776+%E7%9A%84%E8%B3%87%E8%A8%8A&summary=&source=) [](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https://origin-researchcenter.paloaltonetworks.com/blog/2018/10/unit42-threat-brief-information-on-critical-apache-struts-vulnerability-cve-2018-11776/?lang=zh-hant&ts=markdown) \[\](mailto:?subject=威脅簡報：有關重要 Apache Struts 弱點 CVE-2018-11776 的資訊) Link copied By [Christopher Budd](https://www.paloaltonetworks.com/blog/author/christopher-budd/?lang=zh-hant&ts=markdown "Posts by Christopher Budd") Oct 19, 2018 1 minutes [未分類](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e9%a1%9e/?lang=fr&ts=markdown) This post is also available in: [English (英語)](https://origin-researchcenter.paloaltonetworks.com/blog/2018/08/unit42-threat-brief-information-on-critical-apache-struts-vulnerability-cve-2018-11776/ "Switch to 英語(English)") [Nederlands (荷蘭語)](https://origin-researchcenter.paloaltonetworks.com/blog/2018/10/bedreigingsoverzicht-informatie-kritieke-apache-struts-kwetsbaarheid-cve-2018-11776/?lang=nl "Switch to 荷蘭語(Nederlands)") [Deutsch (德語)](https://origin-researchcenter.paloaltonetworks.com/blog/2018/11/bedrohungsbeschreibung-informationen-zur-kritischen-sicherheitsluecke-apache-struts-cve-2018-11776/?lang=de "Switch to 德語(Deutsch)") [Italiano (義大利語)](https://origin-researchcenter.paloaltonetworks.com/blog/2018/11/report-sulle-minacce-informazioni-sulla-vulnerabilita-critica-di-apache-struts-cve-2018-11776/?lang=it "Switch to 義大利語(Italiano)") [한국어 (韓語)](https://origin-researchcenter.paloaltonetworks.com/blog/2018/10/unit42-threat-brief-information-on-critical-apache-struts-vulnerability-cve-2018-11776/?lang=ko "Switch to 韓語(한국어)") [Español (西班牙語)](https://origin-researchcenter.paloaltonetworks.com/blog/2018/11/informe-sobre-amenazas-la-vulnerabilidad-critica-de-apache-struts-cve-2018-11776/?lang=es "Switch to 西班牙語(Español)") [Türkçe (土耳其語)](https://origin-researchcenter.paloaltonetworks.com/blog/2018/11/tehdit-ozeti-kritik-apache-struts-guvenlik-acigi-cve-2018-11776-hakkinda-bilgiler/?lang=tr "Switch to 土耳其語(Türkçe)") **情況概述** 2018 年 8 月 22 日，Apache Foundation ++[發佈](https://cwiki.apache.org/confluence/display/WW/S2-057)++ 重要的安全更新 ++[CVE-2018-1176](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11776)++，這是會影響 Apache Struts 2.3 至 2.3.34 版和 2.5 至 2.5.16 版的遠端程式碼執行弱點。Apache Foundation 已敦促各方盡快套用安全更新。 這個部落格提供相關資訊以利組織評估其弱點風險，並向 Palo Alto Networks 客戶提供防護措施，有助於在套用安全更新之前降低風險。Palo Alto Networks 客戶只需部署 2018 年 8 月 24 日發佈的最新弱點特徵碼，即可獲得充分的保護。 **弱點資訊** Apache Foundation 和安全研究人員 ++[Man Yue Mo](https://semmle.com/news/apache-struts-CVE-2018-11776#was-i-vulnerable)++ 指出，伺服器執行具有弱點的 Apache Struts 版本時，此弱點可以在該伺服器上啟用遠端程式碼執行。攻擊方法是透過向具有弱點的系統發送特製的 URL。在大多數情況下，這表示無需驗證即可入侵此弱點。 攻擊得逞後即可在 Struts 使用的安全脈絡中執行程式碼。在某些情況下，這可能會導致系統遭到完全入侵。 但是，必須注意，在預設設定下無法入侵此弱點。若要成功攻擊系統，必須滿足下列兩項條件： 1. [alwaysSelectFullNamespace](https://stackoverflow.com/questions/17690956/how-to-prevent-the-wildcard-namespace-in-struts#17697478) 旗標在 Struts 設定中設為「true」。(注意：如果您的應用程式使用常用的 ++[Struts Convention 外掛程式](https://struts.apache.org/plugins/convention/)++，則外掛程式預設會將此旗標設定為「true」)。 2. Struts 應用程式會使用未指定命名空間而設定的「動作」，或使用萬用字元命名空間設定的「動作」。此條件適用於 Struts 設定檔案中指定的動作和命名空間。注意：如果您的應用程式使用常見的 Struts Convention 外掛程式，此條件也適用於 Java 程式碼中指定的動作和命名空間。 如果您的 Struts 應用程式不滿足這兩項條件，您的應用程式可能仍然存在弱點，但是目前不會遭受 CVE-2018-11776 的入侵。 尤其是，如果您的應用程式使用常見的 Struts Convention 外掛程式，則相較於不使用該外掛程式的其他 Struts 實作案例，這似乎可能會提高遭到入侵的風險。 **威脅環境資訊** 該弱點於 8 月 22 日與解決該弱點的安全更新一起披露。其中詳細解說此弱點及其目前的入侵方式。另外也提供觀念驗證 (PoC) 程式碼。如上所述，PoC 僅適用於具有弱點且滿足可入侵條件的系統。 有些人注意到，去年在一個安全更新和弱點資訊發佈僅三天後，一個重大的 Struts 弱點即遭到主動攻擊。 目前沒有已知的主動攻擊，而且必須要滿足兩個非預設條件才能入侵此弱點，因此我們所面臨的威脅環境與此不同。 但是，利用現有的 PoC，透過有限的觀察和分析，我們認為在短期內仍可能會出現對於此弱點的入侵。 組織應該對於可能發生的攻擊進行風險評估，直到能夠修補這四個方面為止： 1. 您是否在使用 Struts Convention 外掛程式？ 2. 它們是否滿足入侵所需的兩項條件？ 3. 目前的 PoC 是否有被武器化或用於攻擊的跡象？ 4. 新的 PoC 或攻擊的發展是否使得入侵所需的兩項條件變成非必要？ **為 Palo Alto Networks 客戶提供的指導和防護建議** 執行具有弱點的 Apache Struts 版本的所有組織都應盡快部署安全更新。 組織可以而且應該根據安全政策和風險評估以及目前可用的資訊，優先安排和部署安全更新。 已在 2018 年 8 月 24 日發佈的內容發行版本 8057 (其中包括 ID 33948 名稱：Apache Struts 2 Remote Code Execution Vulnerability) 中部署弱點特徵碼的 Palo Alto Networks 客戶，將會得到保護，有效防禦目前已知針對該弱點發動的入侵。 我們的客戶仍應按照上述建議部署安全更新，但是可以而且應該立即部署最新的弱點特徵碼，以獲得更完善的保護。由於有這種更完善的保護可供採用，我們的客戶在進行有關安全和安全更新部署的決策，以及對弱點和威脅環境進行風險評估時，可以而且應該對此進行考慮。 一如往常，我們正密切監控情勢，如果更多詳細資訊將會即刻為您奉上。 *** ** * ** *** ## Related Blogs ### [未分類](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e9%a1%9e/?lang=fr&ts=markdown) [#### Strata Copilot - 加速邁向自發性網路安全性的未來](https://origin-researchcenter.paloaltonetworks.com/blog/network-security/introducing-strata-copilot/?lang=zh-hant) ### [未分類](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e9%a1%9e/?lang=fr&ts=markdown) [#### 醫療企業是勒索軟體攻擊者的首要目標](https://origin-researchcenter.paloaltonetworks.com/blog/2021/10/healthcare-organizations-are-the-top-target/?lang=zh-hant) ### [未分類](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e9%a1%9e/?lang=fr&ts=markdown) [#### 適用於 5G 的零信任：實現安全的數位轉型](https://origin-researchcenter.paloaltonetworks.com/blog/2021/10/zero-trust-for-5g-digital-transformation/?lang=zh-hant) ### [未分類](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e9%a1%9e/?lang=fr&ts=markdown) [#### 網路攻擊鎖定金融服務企業的 3 個原因以及防禦方式](https://origin-researchcenter.paloaltonetworks.com/blog/2021/10/financial-services-cyberattacks/?lang=zh-hant) ### [未分類](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e9%a1%9e/?lang=fr&ts=markdown) [#### 連續 7 年提供出色的客戶服務](https://origin-researchcenter.paloaltonetworks.com/blog/2021/10/delivering-outstanding-customer-service/?lang=zh-hant) ### [未分類](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e9%a1%9e/?lang=fr&ts=markdown) [#### Palo Alto Networks 研究：61% 的企業難以確保在家工作的遙距網絡安全](https://origin-researchcenter.paloaltonetworks.com/blog/2021/09/state-of-hybrid-workforce-security-2021/?lang=zh-hant) ### Subscribe to the Blog! Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more. ![spinner](https://origin-researchcenter.paloaltonetworks.com/blog/wp-content/themes/panwblog2023/dist/images/ajax-loader.gif) Sign up Please enter a valid email. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) and acknowledge our [Privacy Statement](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown). Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder. This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. {#footer} {#footer} ## Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [Secure AI by Design](https://www.paloaltonetworks.com/precision-ai-security/secure-ai-by-design?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess?ts=markdown) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) * [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform?ts=markdown) * [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners?ts=markdown) ## Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Customers](https://www.paloaltonetworks.com/customers?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) ## Popular Links * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown) * [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![PAN logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) * [Documents](https://www.paloaltonetworks.com/legal?ts=markdown) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language