CVE-2022-45416

What it actually does

Keyboard event strings such as "KeyA" reside at fixed, known addresses, allowing cache-based timing attacks like Prime+Probe to infer which keys are pressed.

Why it matters to the business

Attackers could capture keystrokes in affected browser-based applications, risking exposure of credentials or sensitive input with low but present exploitation likelihood.

How an attack unfolds

An attacker hosts or injects content that elicits keyboard events in the browser, then runs a cache timing side-channel probe to map addresses back to specific key strings and reconstruct input sequences.

How to fix it

Upgrade nextcloud/server (GIT) to commit f6f27bd7f0172817eb2bf6f218a6a5d6131f8e3d.

How to confirm the fix worked

Confirm the patched commit hash is present in the deployed nextcloud/server codebase and test that keyboard event string addresses are no longer statically predictable.

Typical attack path

1. Deliver malicious web content to the target browser
2. Induce keyboard input via user interaction or script
3. Execute Prime+Probe or similar cache timing measurement
4. Map observed addresses to known key strings to recover typed data

How to detect it

Review web server and browser logs for unusual cache-timing or high-frequency event probes; correlate with Nextcloud access patterns indicating side-channel activity.

What your security team should do

• Apply the listed commit immediately due to the 1395-day exposure window
• Audit all browser-dependent Nextcloud deployments for the vulnerable version
• Monitor EPSS trend and reassess if exploit maturity increases