Is the url injection vulnerable or open to exploitation?

What you are witnessing is probably a mitigation for a common vulnerability, OWASP 2013 A10, Unvalidated Redirects and Forwards.

If the application simply redirected to the URL found in the JSON, verbatim, you'd have a problem. Basically anyone who tampers with that JSON could send your browser anywhere they want. This is called an unvalidated redirect.

But the application doesn't do that. Instead, it redirects to a handler within the RootServerOfApplication.com domain, passing the URL from the JSON document as an argument. Presumably, RootServerOfApplication.com/NameOfAplication takes a look at the URL and ensures it is valid (e.g. maybe it makes sure the domain is in a white list, one that presumably includes cloud.com). This mechanism would prevent it from forwarding an end user to myevilurl.org.

You should check it out. Try pasting https://RootServerOfApplication.com/NameOfApplication/^^The URL above with https instead of https^^ directly into your browser and see where it takes you.