TSPortal: Anyone can forge self-deletion requests of any user

Vulnerability

Overview TSPortal, the WikiTide Foundation's Trust and Safety platform, uses Laravel middleware that converts empty strings to null [1]. In the DPAController, leaving the evidence field empty when creating a DPA report results in a null value, making the report appear as a genuine self-deletion request instead of a DPA report [3]. This flaw exists prior to version 30.

Exploitation

An attacker can create a DPA report against any user by selecting a reason such as suspected underage user and leaving the evidence field empty. The resulting report is indistinguishable from a legitimate self-deletion report, as there is no validation to ensure evidence is provided [3]. No authentication beyond basic access to TSPortal is required.

Impact

Successful exploitation could lead to unauthorized deletion of any arbitrary user's data within TSPortal and potentially in subsequent systems if actioned upon [3]. This undermines the integrity of the report handling process.

Mitigation

The issue has been patched in version 30 by either disabling the convertEmptyStringsToNull middleware or adding validation to require evidence in the DPAController's store method [2][3].