docs/security/HOMECORE-security-audit-iter10.md
Branch: feat/adr-126-homecore-impl
Audit date: 2026-05-25
Scope: 8 new crates + integration binary (iter-1 through iter-9)
Auditor: Security-audit agent (claude-sonnet-4-6)
HOMECORE's Rust codebase is structurally sound but ships with two pre-production placeholders that are critical blockers for any production deployment: the HTTP bearer-token validator accepts any non-empty string as a valid token, and the WebSocket auth handshake does the same. Every protected endpoint is therefore fully open to unauthenticated attackers who can reach port 8123.
cargo audit flagged 18 advisories across three dependency trees. Two are
Critical (CVSS 9.0): both are Wasmtime sandbox-escape bugs in the Winch and
Cranelift compiler backends (RUSTSEC-2026-0095/0096). SQLx 0.7.4 carries a
binary-protocol misinterpretation bug (RUSTSEC-2024-0363). The Wasmtime
version must be upgraded before any WASM plugin is loaded in production.
Additional findings: CorsLayer::permissive() allows cross-origin requests from
any domain; the HAP service record hardcodes a predictable setup code and a
broadcast MAC address; hc_log writes plugin output directly to eprintln!
without going through tracing; and the WS subscribe_events command has no
per-connection subscription cap, enabling a resource-exhaustion DoS.
| ID | Severity | Title | File : Line | Description | Remediation |
|---|---|---|---|---|---|
| HC-01 | Critical | Bearer auth accepts any non-empty token (REST) | homecore-api/src/auth.rs:25 and rest.rs (all handlers) | BearerAuth::from_headers returns Ok for any non-empty string. All REST endpoints (/api/config, /api/states, /api/services, call_service) are fully open to any caller. | Implement a token store in P2 before deployment. Until then, enforce network-level ACL so port 8123 is unreachable from untrusted networks. |
| HC-02 | Critical | WebSocket auth handshake accepts any non-empty token | homecore-api/src/ws.rs:61–68 | The WS auth phase validates only that access_token is non-empty. After passing this check the client reaches the full command loop including call_service. An attacker sending {"type":"auth","access_token":"x"} gets a fully authenticated session. | Same as HC-01; block at network until real token store is wired. |
| HC-03 | Critical | Wasmtime 25.0.3 — sandbox-escape via Winch backend (RUSTSEC-2026-0095) | homecore-plugins/Cargo.toml | The Winch compiler backend in Wasmtime 25.0.3 allows a sandboxed WASM plugin to perform out-of-sandbox memory writes (CVSS 9.0). | Upgrade wasmtime to >=36.0.7 or >=42.0.2. |
| HC-04 | Critical | Wasmtime 25.0.3 — sandbox-escape via miscompiled heap access on aarch64 Cranelift (RUSTSEC-2026-0096) | homecore-plugins/Cargo.toml | Miscompiled guest heap access in Cranelift's aarch64 backend enables sandbox escape (CVSS 9.0). Production Pi 5 targets are aarch64. | Upgrade wasmtime to >=36.0.7 or >=42.0.2. |
| HC-05 | High | CorsLayer::permissive() allows all cross-origin requests | homecore-api/src/app.rs:25 | CorsLayer::permissive() sets Access-Control-Allow-Origin: * and allows all methods and headers. Any webpage on any origin can make authenticated API calls using a stored bearer token (when HC-01/02 are fixed). | Replace with an explicit allowlist: CorsLayer::new().allow_origin(expected_origin).allow_methods([GET, POST]). |
| HC-06 | High | SQLx 0.7.4 — binary protocol misinterpretation (RUSTSEC-2024-0363) | homecore-recorder/Cargo.toml | Truncating/overflowing casts in SQLx 0.7.4's binary protocol handling can cause values to be misread. Although HOMECORE only uses SQLite (not MySQL/Postgres), the vulnerable codepath is in the shared crate. | Upgrade sqlx to >=0.8.1. |
| HC-07 | High | No per-connection subscription cap on WS subscribe_events | homecore-api/src/ws.rs:237–295 | A single authenticated WS connection can call subscribe_events in an unbounded loop. Each subscription spawns a Tokio task and takes one broadcast receiver slot. With the bus capacity at 4096 slots, a malicious client can exhaust OS thread/task resources before the bus fills. | Add a per-connection subscription ceiling (e.g., 50). Reject further subscribe_events commands with "too_many_subscriptions". |
| HC-08 | High | Hardcoded HAP setup code and broadcast MAC in production binary | homecore-server/src/main.rs:113–114, homecore-hap/src/bridge.rs:143–144 | The integration binary hard-codes setup_code: "123-45-678" and device_id: "AA:BB:CC:DD:EE:FF". When real HAP pairing lands in P2 any attacker on the local network can pair with the bridge using the published setup code; the broadcast MAC address is also invalid per the HAP specification. | Generate a random setup code and a locally administered unicast MAC at startup (or require them as CLI arguments). Never use a known-fixed setup code. |
| HC-09 | Medium | Wasmtime 25.0.3 — 11 additional medium/low CVEs | homecore-plugins/Cargo.toml | RUSTSEC-2025-0046, -0118, -2026-0020, -0021, -0085, -0086, -0087, -0088, -0089, -0091, -0092, -0093, -0094 affect resource exhaustion, host data leakage, OOB reads/writes, and panics. All are fixed in wasmtime >=36.0.7. | Same fix as HC-03/04: upgrade wasmtime. |
| HC-10 | Medium | hc_log writes plugin output via eprintln! bypassing structured logging | homecore-plugins/src/wasmtime_runtime.rs:297 | Plugin log messages are written directly to stderr via eprintln!, bypassing the tracing subscriber. This means: (a) log level filtering does not apply to plugin output; (b) log aggregation pipelines (e.g., JSON structured logs) miss plugin messages. A verbose or malicious plugin can flood stderr. | Replace eprintln! with tracing::debug!/info!/warn!/error! using the already-imported LogLevel. |
| HC-11 | Medium | No size bound on set_state body or attributes JSON | homecore-api/src/rest.rs:95–108, ws.rs:222–235 | POST /api/states/:entity_id and the WS call_service / get_states paths accept a serde_json::Value body with no size limit beyond Axum's default (2 MB). Specially crafted deeply-nested JSON can cause quadratic parse time or high-memory allocation during serialization. | Apply axum::extract::DefaultBodyLimit::max(65536) on the route or globally; validate JSON depth before accepting. |
| HC-12 | Medium | rsa 0.9.10 — Marvin Attack timing side-channel (RUSTSEC-2023-0071) | transitive via sqlx-mysql 0.7.4 | The rsa crate's decryption is vulnerable to timing-based key recovery. Pulled in by sqlx-mysql even though HOMECORE only uses SQLite. No fix is available upstream. | Add sqlx features sqlite only (remove mysql/postgres from the feature list) to avoid pulling in sqlx-mysql and the rsa transitive dependency. |
| HC-13 | Medium | shlex 0.1.1 — shell-injection via quote API (RUSTSEC-2024-0006) | transitive via wasm3-sys 0.3.0 → wasm3 0.3.1 → homecore-plugins | shlex's quote function can produce unsafe shell strings. Pulled in by the wasm3 build system. Not directly callable from HOMECORE Rust code but present in the binary's dependency tree. | Upgrade shlex to >=1.3.0 or drop the wasm3 dependency if WasmtimeRuntime is the production path. |
| HC-14 | Low | No TLS on the HTTP/WS listener | homecore-server/src/main.rs:122–128 | The Axum listener binds plain TCP (axum::serve). Bearer tokens and all home automation data are transmitted in cleartext. On LAN deployments an attacker with ARP poisoning can intercept credentials. | Add rustls/axum-server TLS termination or document that a TLS-terminating reverse proxy (nginx/Caddy) is required. |
| HC-15 | Low | Migration CLI performs no symlink/traversal check on .storage/ path | homecore-migrate/src/storage.rs:36–37, main.rs:14–32 | HaStorageDir::file_path calls self.path.join(name) where name comes from hard-coded constants, so exploitation requires the --storage argument itself to point outside the intended tree. There is no Path::canonicalize + prefix check. While the current filenames are constants, if P2 makes name data-driven the surface widens. | Add path.canonicalize() + assert prefix after computing file_path if the name ever becomes user-controlled. Document this as a P2 gate. |
| HC-16 | Low | AutomationEngine uses eprintln! for action errors | homecore-automation/src/engine.rs:93–95, 105 | Action errors and lag notices are emitted via eprintln!, not tracing::warn!. Same issues as HC-10: bypasses structured logging. | Replace with tracing::warn!/tracing::error!. |
| HC-17 | Informational | WS call_service authorization is contingent on fixing HC-01/HC-02 | homecore-api/src/ws.rs:222–235 | call_service (including destructive calls such as homeassistant.restart) sits behind the WS auth handshake. Once HC-01 and HC-02 are fixed this path is properly guarded. No additional change needed here beyond those fixes. | No action required beyond HC-02. |
| HC-18 | Informational | hc_state_subscribe accumulates entity strings without eviction | homecore-plugins/src/wasmtime_runtime.rs:263–268 | The PluginStoreData.subscriptions Vec grows without bound if a plugin repeatedly subscribes to the same entity. There is no deduplication. This is a plugin-local memory leak, not a sandbox escape. | Deduplicate on insert: if !caller.data().subscriptions.contains(&eid). |
SQL injection (homecore-recorder/src/db.rs): All queries use sqlx::query
with positional ? bind parameters. No format!-constructed SQL was found in
any path (record_state, record_event, get_state_history, search_semantic,
apply_schema). Clean.
WS bearer token in logs/error messages: The bearer token is extracted and
immediately discarded after the non-empty check at ws.rs:62. It is not passed
to any tracing macro, eprintln!, or error-display path. The access_token
field is not part of any Debug-derived struct that enters a log path. Clean.
REST bearer token in logs/error messages: BearerAuth(token) is Debug
but no handler logs it or includes it in an error response. ApiError variants
do not capture the token. Clean.
WASM linear-memory buffer overflow in hc_state_get/hc_state_set: The
read_str helper validates len < 0 and len > MAX_ABI_BUFFER_BYTES (65536)
before slicing, and uses mem.get(ptr..ptr+len)? which cannot panic. In
hc_state_get phase 3, the write is guarded by json_bytes.len() > out_cap
before attempting the slice. The call_export_str host-to-guest path also uses
.get_mut(ptr..ptr+len).ok_or_else(...) rather than unchecked indexing. No
buffer-overflow vector identified in the host ABI.
WASM JSON ABI escape: Plugins receive and emit plain UTF-8 JSON strings via
the linear-memory ABI. The host deserializes attribute JSON with
serde_json::from_str and defaults to {} on parse failure — no panic path.
No mechanism for a plugin to escape the Cranelift JIT sandbox via the JSON layer
alone was identified; the sandbox-escape risk is in the Cranelift/Winch compiler
backends (HC-03/04).
Path traversal in homecore-migrate: All .storage/ filenames are currently
hard-coded constants ("core.entity_registry", "core.device_registry", etc.)
in the Rust source. The --storage and --config-dir arguments are user-supplied
but refer to the directory root, not individual filenames. No user-controlled
string is concatenated into a file path. Clean at P1 scope (noted as a P2 gate in HC-15).
DoS via event-bus flood from a plugin: A WASM plugin can call hc_state_set
in a tight loop. Each call fires a broadcast::Sender::send on the system channel
(capacity 4096). When the channel is full, send returns 0 (receivers are
dropped/lagged) but does not block or panic. Lagged receivers are notified via
RecvError::Lagged. The state machine itself does not back-pressure the sender.
The flood can cause the recorder and automation engine to lag, but it cannot crash
the host process. Noted as design-level concern; acceptable for P1.
Secrets leakage in homecore-migrate InspectSecrets: The CLI correctly prints
<redacted> for secret values and only logs key names.
The following items MUST be resolved before homecore-server is reachable from
any untrusted network:
HC-01 + HC-02 (Critical) — Implement the token store and validate bearer
tokens in both BearerAuth::from_headers and the WS handle_socket auth
phase. Until this is done every REST and WS endpoint is completely open.
HC-03 + HC-04 (Critical) — Upgrade wasmtime in homecore-plugins/Cargo.toml
from 25.0.3 to >=36.0.7 (or >=42.0.2). The current version has two
confirmed CVSS-9.0 sandbox-escape bugs; loading any third-party WASM plugin
on the current version cannot be considered safe.
HC-06 (High) — Upgrade sqlx from 0.7.4 to >=0.8.1 to eliminate the
binary-protocol misinterpretation bug.
HC-05 (High) — Replace CorsLayer::permissive() with an explicit
origin allowlist before any browser-accessible deployment.
HC-08 (High) — Replace the hardcoded HAP setup code and broadcast MAC address with randomly generated values before P2 real HAP pairing lands.
HC-07 (High) — Add per-connection subscription limit to the WS command loop before exposing the server to untrusted LAN clients.
cargo audit reported 18 advisories against workspace Cargo.lock:
| Advisory | Crate | Severity | Affects HOMECORE |
|---|---|---|---|
| RUSTSEC-2026-0096 | wasmtime 25.0.3 | Critical (9.0) | homecore-plugins |
| RUSTSEC-2026-0095 | wasmtime 25.0.3 | Critical (9.0) | homecore-plugins |
| RUSTSEC-2026-0093 | wasmtime 25.0.3 | Medium (6.9) | homecore-plugins |
| RUSTSEC-2026-0020 | wasmtime 25.0.3 | Medium (6.9) | homecore-plugins |
| RUSTSEC-2026-0021 | wasmtime 25.0.3 | Medium (6.9) | homecore-plugins |
| RUSTSEC-2024-0363 | sqlx 0.7.4 | (no CVSS) | homecore-recorder |
| RUSTSEC-2026-0091 | wasmtime 25.0.3 | Medium (6.1) | homecore-plugins |
| RUSTSEC-2026-0094 | wasmtime 25.0.3 | Medium (6.1) | homecore-plugins |
| RUSTSEC-2026-0089 | wasmtime 25.0.3 | Medium (5.9) | homecore-plugins |
| RUSTSEC-2026-0092 | wasmtime 25.0.3 | Medium (5.9) | homecore-plugins |
| RUSTSEC-2023-0071 | rsa 0.9.10 | Medium (5.9) | transitive via sqlx-mysql |
| RUSTSEC-2026-0085 | wasmtime 25.0.3 | Medium (5.6) | homecore-plugins |
| RUSTSEC-2026-0087 | wasmtime 25.0.3 | Medium (4.1) | homecore-plugins |
| RUSTSEC-2025-0046 | wasmtime 25.0.3 | Low (3.3) | homecore-plugins |
| RUSTSEC-2026-0086 | wasmtime 25.0.3 | Low (2.3) | homecore-plugins |
| RUSTSEC-2026-0088 | wasmtime 25.0.3 | Low (2.3) | homecore-plugins |
| RUSTSEC-2025-0118 | wasmtime 25.0.3 | Low (1.8) | homecore-plugins |
| RUSTSEC-2024-0006 | shlex 0.1.1 | (no CVSS) | transitive via wasm3-sys |
All 15 wasmtime advisories are resolved by upgrading to wasmtime >= 36.0.7.