CVE-2022-36316

What it actually does

An attacker can detect whether a target URL was subject to a redirect by observing subtle differences between PerformanceEntries via the Performance API.

Why it matters to the business

Enables stealthy information gathering about redirect behavior in web applications, potentially aiding phishing or tracking campaigns with low immediate operational disruption but elevated risk in environments handling sensitive redirects.

How an attack unfolds

An attacker embeds JavaScript using the Performance API on a malicious page, loads a target URL that may redirect, and inspects PerformanceEntry differences to confirm redirect presence, informing follow-on attacks such as open redirect abuse.

How to fix it

Upgrade nextcloud/server (GIT) to the fixed commit 1debe060a87e1d50e18dd47b29ea32de3dc4bac6.

How to confirm the fix worked

Verify deployment of commit 1debe060a87e1d50e18dd47b29ea32de3dc4bac6 and confirm Performance API no longer leaks redirect information on test URLs.

Typical attack path

1. Host malicious webpage with Performance API instrumentation
2. Trigger load of target URL potentially subject to redirect
3. Compare PerformanceEntries for timing or entry differences
4. Confirm redirect occurred and leverage for further exploitation

How to detect it

Review web server and application logs for unexpected Performance API calls or JavaScript patterns that probe redirect behavior; correlate with client-side timing measurements on redirect endpoints.

What your security team should do

• Apply the fixed commit 1debe060a87e1d50e18dd47b29ea32de3dc4bac6 immediately across all nextcloud/server instances
• Audit web applications for Performance API usage in redirect flows
• Monitor EPSS trend and re-evaluate if exploit maturity increases