Home Assistant MCP Server: YAML config backups written under www/ are served unauthenticated at /local/

Summary

### Summary

When `ENABLE_YAML_CONFIG_EDITING=true`, every `ha_config_set_yaml` call backs up the pre-edit file to `<config>/www/yaml_backups/`, which Home Assistant serves at `/local/` with **no authentication**. Anyone who can reach the HA web interface can download the most recent pre-edit `configuration.yaml` (or other YAML file) — typically containing plaintext MQTT passwords, REST credentials, webhook IDs, geofence coordinates, and `shell_command` definitions — with zero credentials.

### Details

The backup feature is good — `do_backup` defaults to `True` and protects users from a bad edit. The issue is the location:

- `custom_components/ha_mcp_tools/__init__.py:596` — `backup_dir = config_dir / "www" / "yaml_backups"` - `custom_components/ha_mcp_tools/__init__.py:602` — `backup_file = backup_dir / f"{safe_name}.{timestamp}.bak"` - `custom_components/ha_mcp_tools/__init__.py:606-607,692-693` — backup path returned to caller and logged at INFO

`<config>/www/` is `/local/` and HA serves it unauthenticated by design (intended for static dashboard assets). An attacker discovers the path three ways: (1) it's returned to the MCP client in `result["backup_path"]`; (2) it's logged at INFO and recoverable via `ha_get_logs`; (3) the timestamp format is `%Y%m%d_%H%M%S` — 86,400 candidates per day, enumerable. Backups accumulate (no rotation), so a long-running install holds a chronological history.

**Preconditions:** `ENABLE_YAML_CONFIG_EDITING=true` (off by default), at least one YAML edit made, and the attacker can reach HA's port 8123 (LAN, or internet via Nabu Casa / reverse proxy).

### PoC

A pytest E2E test against a fresh Docker HA container with the custom component installed (using the project's existing `ha_container_with_fresh_config` fixture):

``` [1] ha_config_set_yaml(yaml_path="template", action="add", ...) → success=True [1] backup_path = 'www/yaml_backups/configuration.yaml.20260505_171335.bak' [2] GET http://<ha>:8123/local/yaml_backups/configuration.yaml.20260505_171335.bak (no Authorization header) [2] HTTP 200, 440 bytes — the full pre-edit configuration.yaml [control] GET /api/config without auth → HTTP 401 ```

The control proves the result is meaningful: the same instance returns 401 for an authenticated endpoint; only `/local/` is unauthenticated by HA design.

### Impact

CWE-552 (Files or Directories Accessible to External Parties). Affects users with `ENABLE_YAML_CONFIG_EDITING=true` who have made at least one YAML edit. Anyone who can reach HA port 8123 reads the most recent pre-edit config without credentials. CVSS 6.5 medium (`AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`); 7.5 high if HA is internet-exposed.

### Resolution

Fixed in `7.4.1.dev456` (PR #1180). The fix relocates new backups to `<config>/.ha_mcp_tools_backups/` (config root, not served by `/local/`) and adds a one-time migration on integration setup that moves any pre-existing exposed backups, surfaces a persistent notification telling the user to rotate exposed secrets, and removes the legacy directory if empty.

The fix ships in the next biweekly stable release and is available immediately on the dev channel. Updating to a release containing the fix is sufficient — no manual action required for users who upgrade.

### Manual cleanup (for users who cannot upgrade yet)

If you used `ha_config_set_yaml` on a vulnerable version and cannot wait for the next stable release, manually remove the exposed backups:

``` rm -rf <config>/www/yaml_backups/ ```

Then rotate any secrets that may have been in the YAML files those backups captured (MQTT/REST credentials, webhook IDs, `shell_command` definitions, geofence coordinates). The directory is reachable at `http(s)://<ha-host>:8123/local/yaml_backups/` until removed. After the next addon/package upgrade containing the fix, the integration will run this cleanup automatically and surface a persistent notification with the same rotation guidance.