Callback-url-file-3a-2f-2f-2fproc-2fself-2fenviron

The attacker is attempting to exploit a parameter (in this case, callback-url ) that improperly handles input. By passing the file:// protocol instead of http:// or https:// , they are trying to trick the server into reading its own internal files. Why proc/self/environ ?

This is a form of via custom schemes, especially if the app uses a handler like: callback-url-file-3A-2F-2F-2Fproc-2Fself-2Fenviron