ruvnet--RuView/docs/security/HOMECORE-security-audit-iter10.md

# HOMECORE Security Audit — Iter-10

**Branch**: `feat/adr-126-homecore-impl`  
**Audit date**: 2026-05-25  
**Scope**: 8 new crates + integration binary (iter-1 through iter-9)  
**Auditor**: Security-audit agent (claude-sonnet-4-6)

---

## Executive Summary

HOMECORE's Rust codebase is structurally sound but ships with two pre-production
placeholders that are critical blockers for any production deployment: the HTTP
bearer-token validator accepts **any non-empty string as a valid token**, and the
WebSocket auth handshake does the same. Every protected endpoint is therefore fully
open to unauthenticated attackers who can reach port 8123.

`cargo audit` flagged **18 advisories** across three dependency trees. Two are
Critical (CVSS 9.0): both are Wasmtime sandbox-escape bugs in the Winch and
Cranelift compiler backends (RUSTSEC-2026-0095/0096). SQLx 0.7.4 carries a
binary-protocol misinterpretation bug (RUSTSEC-2024-0363). The Wasmtime
version must be upgraded before any WASM plugin is loaded in production.

Additional findings: `CorsLayer::permissive()` allows cross-origin requests from
any domain; the HAP service record hardcodes a predictable setup code and a
broadcast MAC address; `hc_log` writes plugin output directly to `eprintln!`
without going through `tracing`; and the WS `subscribe_events` command has no
per-connection subscription cap, enabling a resource-exhaustion DoS.

---

## Findings

| ID | Severity | Title | File : Line | Description | Remediation |
|----|----------|-------|-------------|-------------|-------------|
| HC-01 | **Critical** | Bearer auth accepts any non-empty token (REST) | `homecore-api/src/auth.rs:25` and `rest.rs` (all handlers) | `BearerAuth::from_headers` returns `Ok` for any non-empty string. All REST endpoints (`/api/config`, `/api/states`, `/api/services`, `call_service`) are fully open to any caller. | Implement a token store in P2 before deployment. Until then, enforce network-level ACL so port 8123 is unreachable from untrusted networks. |
| HC-02 | **Critical** | WebSocket auth handshake accepts any non-empty token | `homecore-api/src/ws.rs:61–68` | The WS `auth` phase validates only that `access_token` is non-empty. After passing this check the client reaches the full command loop including `call_service`. An attacker sending `{"type":"auth","access_token":"x"}` gets a fully authenticated session. | Same as HC-01; block at network until real token store is wired. |
| HC-03 | **Critical** | Wasmtime 25.0.3 — sandbox-escape via Winch backend (RUSTSEC-2026-0095) | `homecore-plugins/Cargo.toml` | The Winch compiler backend in Wasmtime 25.0.3 allows a sandboxed WASM plugin to perform out-of-sandbox memory writes (CVSS 9.0). | Upgrade `wasmtime` to `>=36.0.7` or `>=42.0.2`. |
| HC-04 | **Critical** | Wasmtime 25.0.3 — sandbox-escape via miscompiled heap access on aarch64 Cranelift (RUSTSEC-2026-0096) | `homecore-plugins/Cargo.toml` | Miscompiled guest heap access in Cranelift's aarch64 backend enables sandbox escape (CVSS 9.0). Production Pi 5 targets are aarch64. | Upgrade `wasmtime` to `>=36.0.7` or `>=42.0.2`. |
| HC-05 | **High** | `CorsLayer::permissive()` allows all cross-origin requests | `homecore-api/src/app.rs:25` | `CorsLayer::permissive()` sets `Access-Control-Allow-Origin: *` and allows all methods and headers. Any webpage on any origin can make authenticated API calls using a stored bearer token (when HC-01/02 are fixed). | Replace with an explicit allowlist: `CorsLayer::new().allow_origin(expected_origin).allow_methods([GET, POST])`. |
| HC-06 | **High** | SQLx 0.7.4 — binary protocol misinterpretation (RUSTSEC-2024-0363) | `homecore-recorder/Cargo.toml` | Truncating/overflowing casts in SQLx 0.7.4's binary protocol handling can cause values to be misread. Although HOMECORE only uses SQLite (not MySQL/Postgres), the vulnerable codepath is in the shared crate. | Upgrade `sqlx` to `>=0.8.1`. |
| HC-07 | **High** | No per-connection subscription cap on WS `subscribe_events` | `homecore-api/src/ws.rs:237–295` | A single authenticated WS connection can call `subscribe_events` in an unbounded loop. Each subscription spawns a Tokio task and takes one broadcast receiver slot. With the bus capacity at 4096 slots, a malicious client can exhaust OS thread/task resources before the bus fills. | Add a per-connection subscription ceiling (e.g., 50). Reject further `subscribe_events` commands with `"too_many_subscriptions"`. |
| HC-08 | **High** | Hardcoded HAP setup code and broadcast MAC in production binary | `homecore-server/src/main.rs:113–114`, `homecore-hap/src/bridge.rs:143–144` | The integration binary hard-codes `setup_code: "123-45-678"` and `device_id: "AA:BB:CC:DD:EE:FF"`. When real HAP pairing lands in P2 any attacker on the local network can pair with the bridge using the published setup code; the broadcast MAC address is also invalid per the HAP specification. | Generate a random setup code and a locally administered unicast MAC at startup (or require them as CLI arguments). Never use a known-fixed setup code. |
| HC-09 | **Medium** | Wasmtime 25.0.3 — 11 additional medium/low CVEs | `homecore-plugins/Cargo.toml` | RUSTSEC-2025-0046, -0118, -2026-0020, -0021, -0085, -0086, -0087, -0088, -0089, -0091, -0092, -0093, -0094 affect resource exhaustion, host data leakage, OOB reads/writes, and panics. All are fixed in wasmtime `>=36.0.7`. | Same fix as HC-03/04: upgrade wasmtime. |
| HC-10 | **Medium** | `hc_log` writes plugin output via `eprintln!` bypassing structured logging | `homecore-plugins/src/wasmtime_runtime.rs:297` | Plugin log messages are written directly to stderr via `eprintln!`, bypassing the `tracing` subscriber. This means: (a) log level filtering does not apply to plugin output; (b) log aggregation pipelines (e.g., JSON structured logs) miss plugin messages. A verbose or malicious plugin can flood stderr. | Replace `eprintln!` with `tracing::debug!/info!/warn!/error!` using the already-imported `LogLevel`. |
| HC-11 | **Medium** | No size bound on `set_state` body or `attributes` JSON | `homecore-api/src/rest.rs:95–108`, `ws.rs:222–235` | `POST /api/states/:entity_id` and the WS `call_service` / `get_states` paths accept a `serde_json::Value` body with no size limit beyond Axum's default (2 MB). Specially crafted deeply-nested JSON can cause quadratic parse time or high-memory allocation during serialization. | Apply `axum::extract::DefaultBodyLimit::max(65536)` on the route or globally; validate JSON depth before accepting. |
| HC-12 | **Medium** | `rsa 0.9.10` — Marvin Attack timing side-channel (RUSTSEC-2023-0071) | transitive via `sqlx-mysql 0.7.4` | The `rsa` crate's decryption is vulnerable to timing-based key recovery. Pulled in by `sqlx-mysql` even though HOMECORE only uses SQLite. No fix is available upstream. | Add `sqlx` features `sqlite` only (remove `mysql`/`postgres` from the feature list) to avoid pulling in `sqlx-mysql` and the `rsa` transitive dependency. |
| HC-13 | **Medium** | `shlex 0.1.1` — shell-injection via quote API (RUSTSEC-2024-0006) | transitive via `wasm3-sys 0.3.0 → wasm3 0.3.1 → homecore-plugins` | `shlex`'s quote function can produce unsafe shell strings. Pulled in by the `wasm3` build system. Not directly callable from HOMECORE Rust code but present in the binary's dependency tree. | Upgrade `shlex` to `>=1.3.0` or drop the `wasm3` dependency if `WasmtimeRuntime` is the production path. |
| HC-14 | **Low** | No TLS on the HTTP/WS listener | `homecore-server/src/main.rs:122–128` | The Axum listener binds plain TCP (`axum::serve`). Bearer tokens and all home automation data are transmitted in cleartext. On LAN deployments an attacker with ARP poisoning can intercept credentials. | Add `rustls`/`axum-server` TLS termination or document that a TLS-terminating reverse proxy (nginx/Caddy) is required. |
| HC-15 | **Low** | Migration CLI performs no symlink/traversal check on `.storage/` path | `homecore-migrate/src/storage.rs:36–37`, `main.rs:14–32` | `HaStorageDir::file_path` calls `self.path.join(name)` where `name` comes from hard-coded constants, so exploitation requires the `--storage` argument itself to point outside the intended tree. There is no `Path::canonicalize` + prefix check. While the current filenames are constants, if P2 makes `name` data-driven the surface widens. | Add `path.canonicalize()` + assert prefix after computing `file_path` if the name ever becomes user-controlled. Document this as a P2 gate. |
| HC-16 | **Low** | `AutomationEngine` uses `eprintln!` for action errors | `homecore-automation/src/engine.rs:93–95, 105` | Action errors and lag notices are emitted via `eprintln!`, not `tracing::warn!`. Same issues as HC-10: bypasses structured logging. | Replace with `tracing::warn!`/`tracing::error!`. |
| HC-17 | **Informational** | WS `call_service` authorization is contingent on fixing HC-01/HC-02 | `homecore-api/src/ws.rs:222–235` | `call_service` (including destructive calls such as `homeassistant.restart`) sits behind the WS auth handshake. Once HC-01 and HC-02 are fixed this path is properly guarded. No additional change needed here beyond those fixes. | No action required beyond HC-02. |
| HC-18 | **Informational** | `hc_state_subscribe` accumulates entity strings without eviction | `homecore-plugins/src/wasmtime_runtime.rs:263–268` | The `PluginStoreData.subscriptions` Vec grows without bound if a plugin repeatedly subscribes to the same entity. There is no deduplication. This is a plugin-local memory leak, not a sandbox escape. | Deduplicate on insert: `if !caller.data().subscriptions.contains(&eid)`. |

---

## Negative-Result Section (Surfaces Checked and Found Clean)

**SQL injection (homecore-recorder/src/db.rs)**: All queries use `sqlx::query`
with positional `?` bind parameters. No `format!`-constructed SQL was found in
any path (`record_state`, `record_event`, `get_state_history`, `search_semantic`,
`apply_schema`). Clean.

**WS bearer token in logs/error messages**: The bearer token is extracted and
immediately discarded after the non-empty check at ws.rs:62. It is not passed
to any `tracing` macro, `eprintln!`, or error-display path. The `access_token`
field is not part of any `Debug`-derived struct that enters a log path. Clean.

**REST bearer token in logs/error messages**: `BearerAuth(token)` is `Debug`
but no handler logs it or includes it in an error response. `ApiError` variants
do not capture the token. Clean.

**WASM linear-memory buffer overflow in `hc_state_get`/`hc_state_set`**: The
`read_str` helper validates `len < 0` and `len > MAX_ABI_BUFFER_BYTES (65536)`
before slicing, and uses `mem.get(ptr..ptr+len)?` which cannot panic. In
`hc_state_get` phase 3, the write is guarded by `json_bytes.len() > out_cap`
before attempting the slice. The `call_export_str` host-to-guest path also uses
`.get_mut(ptr..ptr+len).ok_or_else(...)` rather than unchecked indexing. No
buffer-overflow vector identified in the host ABI.

**WASM JSON ABI escape**: Plugins receive and emit plain UTF-8 JSON strings via
the linear-memory ABI. The host deserializes attribute JSON with
`serde_json::from_str` and defaults to `{}` on parse failure — no panic path.
No mechanism for a plugin to escape the Cranelift JIT sandbox via the JSON layer
alone was identified; the sandbox-escape risk is in the Cranelift/Winch compiler
backends (HC-03/04).

**Path traversal in homecore-migrate**: All `.storage/` filenames are currently
hard-coded constants (`"core.entity_registry"`, `"core.device_registry"`, etc.)
in the Rust source. The `--storage` and `--config-dir` arguments are user-supplied
but refer to the directory root, not individual filenames. No user-controlled
string is concatenated into a file path. Clean at P1 scope (noted as a P2 gate in HC-15).

**DoS via event-bus flood from a plugin**: A WASM plugin can call `hc_state_set`
in a tight loop. Each call fires a `broadcast::Sender::send` on the system channel
(capacity 4096). When the channel is full, `send` returns 0 (receivers are
dropped/lagged) but does not block or panic. Lagged receivers are notified via
`RecvError::Lagged`. The state machine itself does not back-pressure the sender.
The flood can cause the recorder and automation engine to lag, but it cannot crash
the host process. Noted as design-level concern; acceptable for P1.

**Secrets leakage in homecore-migrate InspectSecrets**: The CLI correctly prints
`<redacted>` for secret values and only logs key names.

---

## Critical-Path Remediation List (Required Before Production Deployment)

The following items MUST be resolved before `homecore-server` is reachable from
any untrusted network:

1. **HC-01 + HC-02 (Critical)** — Implement the token store and validate bearer
   tokens in both `BearerAuth::from_headers` and the WS `handle_socket` auth
   phase. Until this is done every REST and WS endpoint is completely open.

2. **HC-03 + HC-04 (Critical)** — Upgrade `wasmtime` in `homecore-plugins/Cargo.toml`
   from `25.0.3` to `>=36.0.7` (or `>=42.0.2`). The current version has two
   confirmed CVSS-9.0 sandbox-escape bugs; loading any third-party WASM plugin
   on the current version cannot be considered safe.

3. **HC-06 (High)** — Upgrade `sqlx` from `0.7.4` to `>=0.8.1` to eliminate the
   binary-protocol misinterpretation bug.

4. **HC-05 (High)** — Replace `CorsLayer::permissive()` with an explicit
   origin allowlist before any browser-accessible deployment.

5. **HC-08 (High)** — Replace the hardcoded HAP setup code and broadcast MAC
   address with randomly generated values before P2 real HAP pairing lands.

6. **HC-07 (High)** — Add per-connection subscription limit to the WS command
   loop before exposing the server to untrusted LAN clients.

---

## Dependency CVE Summary

`cargo audit` reported **18 advisories** against workspace `Cargo.lock`:

| Advisory | Crate | Severity | Affects HOMECORE |
|----------|-------|----------|------------------|
| RUSTSEC-2026-0096 | wasmtime 25.0.3 | Critical (9.0) | homecore-plugins |
| RUSTSEC-2026-0095 | wasmtime 25.0.3 | Critical (9.0) | homecore-plugins |
| RUSTSEC-2026-0093 | wasmtime 25.0.3 | Medium (6.9) | homecore-plugins |
| RUSTSEC-2026-0020 | wasmtime 25.0.3 | Medium (6.9) | homecore-plugins |
| RUSTSEC-2026-0021 | wasmtime 25.0.3 | Medium (6.9) | homecore-plugins |
| RUSTSEC-2024-0363 | sqlx 0.7.4 | (no CVSS) | homecore-recorder |
| RUSTSEC-2026-0091 | wasmtime 25.0.3 | Medium (6.1) | homecore-plugins |
| RUSTSEC-2026-0094 | wasmtime 25.0.3 | Medium (6.1) | homecore-plugins |
| RUSTSEC-2026-0089 | wasmtime 25.0.3 | Medium (5.9) | homecore-plugins |
| RUSTSEC-2026-0092 | wasmtime 25.0.3 | Medium (5.9) | homecore-plugins |
| RUSTSEC-2023-0071 | rsa 0.9.10 | Medium (5.9) | transitive via sqlx-mysql |
| RUSTSEC-2026-0085 | wasmtime 25.0.3 | Medium (5.6) | homecore-plugins |
| RUSTSEC-2026-0087 | wasmtime 25.0.3 | Medium (4.1) | homecore-plugins |
| RUSTSEC-2025-0046 | wasmtime 25.0.3 | Low (3.3) | homecore-plugins |
| RUSTSEC-2026-0086 | wasmtime 25.0.3 | Low (2.3) | homecore-plugins |
| RUSTSEC-2026-0088 | wasmtime 25.0.3 | Low (2.3) | homecore-plugins |
| RUSTSEC-2025-0118 | wasmtime 25.0.3 | Low (1.8) | homecore-plugins |
| RUSTSEC-2024-0006 | shlex 0.1.1 | (no CVSS) | transitive via wasm3-sys |

All 15 wasmtime advisories are resolved by upgrading to `wasmtime >= 36.0.7`.