CVE-2023-33510

Jeecg P3 Biz Chat 1.0.5 lets a remote attacker read arbitrary files off the server through specific request parameters — a path-traversal-style disclosure that requires no authentication. The immediate payoff is whatever lives on disk: application configuration, database credentials, private keys, session data. It doesn't grant code execution by itself, but unauthenticated file read is often the opening move that supplies the credentials for the next one.

The urgency is moderate and specific. This is a small-footprint application rather than something on every scanner's hitlist, so the realistic threat is a targeted actor or an opportunistic scan that happens to fingerprint it, not a global botnet campaign. But the barrier is genuinely low — no login to defeat — so any exposed instance is trivially harvestable, and leaked secrets rarely stay contained to the box they came from.

We approach this through reachability and detection. First, does this app exist anywhere we operate and is it internet-facing; for most estates the honest answer is that it isn't present at all. Where it is, arbitrary file read is very visible in request logs — traversal sequences and unexpected file paths — so we lean on detection and virtual patching at the proxy to buy time while the instance is isolated or retired.