Adjust Tenable integration by requiring auth and validating host URLs

apps/backend/.env-example

@@ -40,7 +40,7 @@ NGINX_HOST=<Templated out as the 'server_name' for the NGINX configuration (no d
 
 ## External interfaces 
 SPLUNK_HOST_URL=<The full Uniform Resource Locator (URL) without the port for the Splunk host (no default, must be set if connecting to Splunk)>
-TENABLE_HOST_URL=<The full Uniform Resource Locator (URL) without the port for the Tenable.SC host (no default, must be set if connecting to Tenable)>
+TENABLE_HOST_URL=<The full Uniform Resource Locator (URL) without the port for the Tenable.SC host (no default, must be set if connecting to Tenable). For multiple allowed hosts, separate with newlines (not commas, since commas are valid URI characters), e.g. TENABLE_HOST_URL='https://a.example.com\nhttps://b.example.com'. Client-supplied host_url values not matching an entry in this list are rejected>
 
 # Authentication
 

apps/backend/config/app_config.ts

@@ -27,11 +27,11 @@
   }
 
   set(key: string, value: string | undefined): void {
     this.envConfig[key] = value;
   }
 
   get(key: string): string | undefined {
     return process.env[key] || this.envConfig[key];
   }
 
   getExternalUrl(): string {
@@ -52,13 +52,34 @@
     }
   }
 
-  getTenableHostUrl(): string {
+  // Newline-separated allowlist of Tenable.SC hosts for the login/proxy endpoints
+  // (commas are valid, unencoded URI characters, so they can't be the delimiter).
+  // Entries must include a protocol; malformed entries throw at startup.
+  getTenableHostUrl(): string[] {
     const tenable_host_url = this.get('TENABLE_HOST_URL');
-    if (tenable_host_url !== undefined) {
-      return tenable_host_url;
-    } else {
-      return '';
+    if (tenable_host_url === undefined) {
+      return [];
     }
+    return tenable_host_url
+      .split(/\r?\n/)
+      .map((url) => url.trim())
+      .filter((url) => url.length > 0)
+      .map((url) => {
+        let parsed: URL;
+        try {
+          parsed = new URL(url);
+        } catch {
+          throw new Error(
+            `Invalid TENABLE_HOST_URL entry "${url}": must be a complete URL including protocol (e.g. https://example.com)`
+          );
+        }
+        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+          throw new Error(
+            `Invalid TENABLE_HOST_URL entry "${url}": protocol must be http or https`
+          );
+        }
+        return parsed.origin;
+      });
   }
 
   getDatabaseName(): string {
@@ -91,8 +112,8 @@
         sslKey = this.get('DATABASE_SSL_KEY');
       } else {
         // Verify file exists
         if (fs.statSync(this.get('DATABASE_SSL_KEY')!).isFile()) {
           sslKey = fs.readFileSync(this.get('DATABASE_SSL_KEY')!);
         } else {
           throw new Error('SSL Key file does not exist');
         }
@@ -104,8 +125,8 @@
         sslCert = this.get('DATABASE_SSL_CERT');
       } else {
         // Verify file exists
         if (fs.statSync(this.get('DATABASE_SSL_CERT')!).isFile()) {
           sslCert = fs.readFileSync(this.get('DATABASE_SSL_CERT')!);
         } else {
           throw new Error('SSL Cert file does not exist');
         }
@@ -117,8 +138,8 @@
         sslCA = this.get('DATABASE_SSL_CA');
       } else {
         // Verify file exists
         if (fs.statSync(this.get('DATABASE_SSL_CA')!).isFile()) {
           sslCA = fs.readFileSync(this.get('DATABASE_SSL_CA')!);
         } else {
           throw new Error('SSL CA file does not exist');
         }
@@ -162,7 +183,7 @@
       return false;
     } else {
       const pattern =
         /^(?:([^:\/?#\s]+):\/{2})?(?:([^@\/?#\s]+)@)?([^\/?#\s]+)?(?:\/([^?#\s]*))?(?:[?]([^#\s]+))?\S*$/;
       const matches = url.match(pattern);
 
       if (matches === null) {

apps/backend/src/config/config.service.ts

@@ -74,7 +74,7 @@ export class ConfigService {
     return this.appConfig.getSplunkHostUrl();
   }
 
-  getTenableHostUrl(): string {
+  getTenableHostUrl(): string[] {
     return this.appConfig.getTenableHostUrl();
   }
 

apps/backend/src/config/dto/startup-settings.dto.ts

@@ -12,7 +12,7 @@ export class StartupSettingsDto implements IStartupSettings {
   readonly ldap: boolean;
   readonly registrationEnabled: boolean;
   readonly localLoginEnabled: boolean;
-  readonly tenableHostUrl: string;
+  readonly tenableHostUrl: string[];
   readonly forceTenableFrontend: boolean;
   readonly splunkHostUrl: string;
 

apps/backend/src/main.ts

@@ -58,7 +58,7 @@ async function bootstrap() {
           "'self'",
           'https://api.github.com',
           'https://sts.amazonaws.com',
-          configService.getTenableHostUrl(),
+          ...configService.getTenableHostUrl(),
           configService.getSplunkHostUrl()
         ].filter((source) => source)
       }

apps/backend/src/tenable/tenable.controller.ts

@@ -6,9 +6,12 @@
   Body,
   HttpException,
   HttpStatus,
-  All
+  All,
+  UseGuards
 } from '@nestjs/common';
 import {TenableService} from './tenable.service';
+import {JwtAuthGuard} from '../guards/jwt-auth.guard';
+import {ConfigService} from '../config/config.service';
 import axios from 'axios';
 import {Request, Response} from 'express';
 
@@ -30,8 +33,43 @@
 // It allows users to log in with their Tenable credentials and then proxies all subsequent requests
 // to the Tenable API, handling authentication via session storage.
 @Controller('api/tenable')
+@UseGuards(JwtAuthGuard)
 export class TenableController {
-  constructor(private readonly tenableService: TenableService) {}
+  constructor(
+    private readonly tenableService: TenableService,
+    private readonly configService: ConfigService
+  ) {}
+
+  // Resolves host_url to its allowlisted origin, or null if not allowed
+  private resolveAllowedHostUrl(host_url: string): string | null {
+    const allowlist = this.configService.getTenableHostUrl();
+    if (allowlist.length === 0) {
+      return null;
+    }
+    try {
+      const parsed = new URL(host_url); // requires a protocol; throws otherwise
+
+      if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        return null;
+      }
+
+      // Reject extra path/query/fragment
+      const hasExtra =
+        (parsed.pathname !== '' && parsed.pathname !== '/') ||
+        parsed.search !== '' ||
+        parsed.hash !== '';
+      if (hasExtra) {
+        return null;
+      }
+
+      const match = allowlist.includes(parsed.origin);
+
+      // Only the parsed origin (never the raw input) is used downstream
+      return match ? parsed.origin : null;
+    } catch {
+      return null;
+    }
+  }
 
   @Post('login')
   /**
@@ -42,7 +80,7 @@
    * @returns An object indicating success and the authenticated user's data from Tenable.
    * @throws {HttpException} If any credentials are missing or if authentication fails.
    */
   async login(
     @Req() req: Request,
     @Body() body: {host_url: string; accesskey: string; secretkey: string}
   ) {
@@ -52,17 +90,30 @@
       throw new HttpException('Missing credentials', HttpStatus.BAD_REQUEST);
     }
 
+    const allowedHostUrl = this.resolveAllowedHostUrl(host_url);
+    if (!allowedHostUrl) {
+      // 400, not 403: the frontend treats any 403 here as a credentials error.
+      throw new HttpException(
+        {
+          status: HttpStatus.BAD_REQUEST,
+          message: 'Tenable host URL is not in the configured allowlist',
+          code: 'HOST_NOT_ALLOWED'
+        },
+        HttpStatus.BAD_REQUEST
+      );
+    }
+
     try {
-      // This helps prevent double slashes in the resulting URL if host_url ends with a slash.
-      const fullUrl = `${host_url.replace(/\/$/, '')}/rest/currentUser`;
+      // allowedHostUrl is the parsed origin, so no trailing slash to strip.
+      const fullUrl = `${allowedHostUrl}/rest/currentUser`;
       const result = await axios.get(fullUrl, {
         headers: {
           'x-apikey': `accesskey=${accesskey}; secretkey=${secretkey}`
         }
       });
 
-      // Assign the Tenable credentials to the session
-      req.session.tenable = {host_url, accesskey, secretkey};
+      // Store the normalized, allowlisted origin rather than the raw client value.
+      req.session.tenable = {host_url: allowedHostUrl, accesskey, secretkey};
 
       // Return the authenticated user data
       // Note: result.data is already a plain object, no need to convert it.

apps/backend/src/tenable/tenable.module.ts

@@ -1,11 +1,13 @@
 import {Module} from '@nestjs/common';
 import {TenableController} from './tenable.controller';
 import {TenableService} from './tenable.service';
+import {ConfigModule} from '../config/config.module';
 
 // NestJS module definition for the Tenable proxy feature.
 // Registers the controller and service needed for routing Tenable requests.
 
 @Module({
+  imports: [ConfigModule],
   // Handles HTTP requests related to Tenable
   controllers: [TenableController],
   // Provides logic for proxying and interacting with Tenable API

apps/frontend/src/components/global/upload_tabs/tenable/AuthStep.vue

@@ -71,7 +71,7 @@
     FileList
   }
 })
 export default class AuthStep extends Vue {
   accesskey = '';
   secretkey = '';
   hostname = '';
@@ -138,9 +138,9 @@
   mounted() {
     this.accesskey = localAccesskey.getDefault('');
     this.secretkey = localSecretkey.getDefault('');
-    // If the hostname is not set, use the default from the server module
+    // If the hostname is not set, use the first configured default from the server module
     // (if not running in server mode the default is empty)
-    this.hostname = localHostname.getDefault(ServerModule.tenableHostUrl);
+    this.hostname = localHostname.getDefault(ServerModule.tenableHostUrl[0] ?? '');
   }
 }
 </script>

apps/frontend/src/store/server.ts

@@ -36,7 +36,7 @@ export interface IServerState {
   ldap: boolean;
   localLoginEnabled: boolean;
   userInfo: IUser;
-  tenableHostUrl: string;
+  tenableHostUrl: string[];
   forceTenableFrontend: boolean;
   splunkHostUrl: string;
 }
@@ -68,7 +68,7 @@ class Server extends VuexModule implements IServerState {
   externalUrl: string = '';
   allUsers: ISlimUser[] = [];
   oidcName = '';
-  tenableHostUrl: string = '';
+  tenableHostUrl: string[] = [];
   forceTenableFrontend = false; // If true, the frontend will use Tenable.SC Lite features
   splunkHostUrl: string = '';
   /** Our currently granted JWT token */

apps/frontend/src/utilities/tenable_util.ts

@@ -140,7 +140,7 @@ export class TenableUtil {
     const DEFAULT_REJECT_MSG =
       `${error.name}: ${(error.response?.data?.message ?? error.message)}, 
        ${error.response?.data?.code ?? error.code}`;
-    const TENABLE_HOST_URL = ServerModule.tenableHostUrl;
+    const TENABLE_HOST_URLS = ServerModule.tenableHostUrl;
     const TENABLE_CSP_NOT_SET =
       'The Content Security Policy directive environment variable "TENABLE_HOST_URL" is not configured. See Help for additional instructions.';
 
@@ -159,8 +159,10 @@ export class TenableUtil {
           if (this.isServer) {
             if (error.response?.data?.code === 'INVALID_HOST_URL') { // Custom set in the backend
               rejectMsg = (error.response?.data?.message ?? 'Tenable host URL to IP address resolution failed');
+            } else if (error.response?.data?.code === 'HOST_NOT_ALLOWED') { // Custom set in the backend
+              rejectMsg = (error.response?.data?.message ?? 'Tenable host URL is not in the configured allowlist');
             } else if (error.response?.data?.message) {
-              rejectMsg = this.getCSPErrorMsg(this.hostConfig.host_url, TENABLE_HOST_URL)
+              rejectMsg = this.getCSPErrorMsg(this.hostConfig.host_url, TENABLE_HOST_URLS)
             } else {
               rejectMsg = DEFAULT_REJECT_MSG
             }
@@ -173,7 +175,7 @@ export class TenableUtil {
             'Unauthorized (missing or not accepted credentials): ' +
             (error.response?.data?.message ?? error.message);
         } else if (error.status == 404) {
-          if (this.isServer && !TENABLE_HOST_URL) {
+          if (this.isServer && !TENABLE_HOST_URLS.length) {
             rejectMsg = TENABLE_CSP_NOT_SET;
           } else {
             rejectMsg = `Network Error -> ${DEFAULT_REJECT_MSG}`;    
@@ -208,12 +210,12 @@ export class TenableUtil {
       if (error.code == 'ERR_NETWORK') {
         // Check if the tenable url was provided - Content Security Policy (CSP)
         const corsReject = `Possible access blocked by CORS or connection refused by the host: ${error.config.baseURL}. See Help for additional instructions. Received Error: ${error.message}`;
-        if (TENABLE_HOST_URL) {
-          // If the URL is listed in the allows domains
+        if (TENABLE_HOST_URLS.length) {
+          // If the URL is listed in the allowed domains
           // (.env variable TENABLE_HOST_URL) check if they match
-          if (!error.config.baseURL.includes(TENABLE_HOST_URL)) {
+          if (!TENABLE_HOST_URLS.some((url) => error.config.baseURL.includes(url))) {
             if (error.config.baseURL) {
-              rejectMsg = this.getCSPErrorMsg(error.config.baseURL, TENABLE_HOST_URL)
+              rejectMsg = this.getCSPErrorMsg(error.config.baseURL, TENABLE_HOST_URLS)
             } else {
               // we assume that the connection was rejected, most likely is that the network path does not exist
               rejectMsg = 'Connection refused by host, or broken network path'
@@ -375,11 +377,11 @@ export class TenableUtil {
    * Generates an error message indicating a Content Security Policy (CSP) violation.
    *
    * @param baseURL - The hostname that triggered the CSP violation.
-   * @param tenableUrl - The hostname allowed by the CSP.
+   * @param tenableUrls - The hostnames allowed by the CSP.
    * @returns A string describing the CSP violation, including the offending and allowed hostnames.
    */
-  getCSPErrorMsg(baseURL: string, tenableUrl: string): string {
-    return `Hostname: ${baseURL?.trim() || 'Unknown host'} violates the Content Security Policy (CSP). The host allowed by the CSP is: ${tenableUrl?.trim() || 'Host not set'}`;
+  getCSPErrorMsg(baseURL: string, tenableUrls: string[]): string {
+    return `Hostname: ${baseURL?.trim() || 'Unknown host'} violates the Content Security Policy (CSP). The host(s) allowed by the CSP: ${tenableUrls.length ? tenableUrls.join(', ') : 'Host not set'}`;
   }
 
 }

libs/common/interfaces/config/startup-settings.interface.ts

@@ -10,7 +10,7 @@ export interface IStartupSettings {
   readonly ldap: boolean;
   readonly registrationEnabled: boolean;
   readonly localLoginEnabled: boolean;
-  readonly tenableHostUrl: string;
+  readonly tenableHostUrl: string[];
   readonly forceTenableFrontend: boolean;
   readonly splunkHostUrl: string;
 }