AIYA-CMS 文件提取（Alist API） WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.1.0

Findings

2

Worst severity

high

Content hash

2ec9f53e5ef2d46544c00c5c… Copy

Findings

• high Unauthenticated Alist file listing and download via alist_request_data AJAX

  missing_auth

  wp_ajax_nopriv_alist_request_data and wp_ajax_alist_request_data both call aya_alist_callback_ajax_post. The handler verifies only nonce action alist_cli_data_nonce — no capability check, no path allow-list, no signed shortcode payload. Default alist_client_ajax_load is true, so every public [alist_cli] render prints wp_create_nonce() plus the query JSON in an inline fetch(); unauthenticated users share that uid-0 nonce. An attacker then POSTs data_atts as JSON with query_method_is list|get|search and an arbitrary path/parent/keywords/password/per_page. aya_alist_template_workflow_main() rejects other methods (mkdir/remove/etc. are not reachable) but forwards the whole decoded object to Alist_API::fs_request() using the site-stored Alist username/password JWT (aya_alist_transient_token). Templates then output listings and aya_alist_format_file_link() builds working download URLs (https://{alist}/d{path}?sign=... by default, or raw cloud URLs when view_link_type is raw_url). Consequence: any visitor who can load a page that uses the shortcode (the intended deployment) can enumerate and download every object the configured Alist account can read, not merely the folder the editor chose. Same endpoint also accepts per_page=0 which makes aya_alist_format_page_item() loop while $i <= ceil($total/0) (INF), or a huge per_page with method=search which issues one fs_get per hit.

  inc/client-templates.php:302-409

  Recommendation

  Do not trust client JSON as the Alist query. Sign (HMAC) the shortcode attributes server-side and reject unsigned or mutated path/method/parent. Alternatively look up the allowed query by a server-issued token rather than echoing the full request. Keep nopriv only if listings are meant to be public, and still constrain paths. Cap per_page, reject non-positive page sizes, and do not pass extra keys through to fs_request().

• medium Reflected XSS via unescaped Alist AJAX HTML consumed by innerHTML

  xss_reflected

  inc/ has no esc_html/esc_attr/esc_url. aya_alist_template_search_result() concatenates $fs_query['keywords'] into an h6; aya_alist_template_file_tables() concatenates $fs_query['path']; file_detail echoes $fs_data['provider'] and file names; readme is printed as HTML when alist_client_display_readme is on; aya_alist_template_error() appends the raw Alist error string; download hrefs are unquoted-safe only by accident. The default async loader assigns that markup with container.innerHTML = content (event handlers execute). Because data_atts is attacker-controlled on the nopriv AJAX action (see missing_auth finding), a logged-out visitor who is CSRF'd with the public uid-0 nonce receives text/html from admin-ajax.php containing those fields. The reliable reflected vector is method=search after Alist search returns an array (even empty content): keywords are echoed before the loop. Contributor/Author shortcode attributes are a weaker stored path because wp_kses_post strips event handlers from angle-bracket tags on save; the AJAX POST bypasses kses entirely.

  inc/client-templates.php:331-350,450-451,493,514,567

  Recommendation

  Escape path, keywords, file names, provider, and error strings with esc_html(); pass hrefs through esc_url(); run readme through wp_kses_post() if HTML is intentional. Prefer DOM text assignment over innerHTML for the AJAX loader. Return JSON from the AJAX action instead of HTML fragments so admin-ajax.php is not a reflected HTML document.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.