Adjust Tenable integration by requiring auth and validating host URLs

apps/backend/.env-example

@@ -41,6 +41,7 @@ NGINX_HOST=<Templated out as the 'server_name' for the NGINX configuration (no d
 ## External interfaces 
 SPLUNK_HOST_URL=<The full Uniform Resource Locator (URL) without the port for the Splunk host (no default, must be set if connecting to Splunk)>
 TENABLE_HOST_URL=<The full Uniform Resource Locator (URL) without the port for the Tenable.SC host (no default, must be set if connecting to Tenable)>
+TENABLE_HOST_URLS=<Comma-separated allowlist of full Tenable.SC host URLs permitted for login (e.g. https://a.example.com,https://b.example.com). Client-supplied host_url values not in this list are rejected>
 
 # Authentication
 

apps/backend/config/app_config.ts

@@ -27,11 +27,11 @@
   }
 
   set(key: string, value: string | undefined): void {
     this.envConfig[key] = value;
   }
 
   get(key: string): string | undefined {
     return process.env[key] || this.envConfig[key];
   }
 
   getExternalUrl(): string {
@@ -61,6 +61,19 @@
     }
   }
 
+  // Comma-separated allowlist of Tenable.SC hosts permitted for the login/proxy endpoints.
+  getTenableHostUrls(): string[] {
+    const tenable_host_urls = this.get('TENABLE_HOST_URLS');
+    if (tenable_host_urls !== undefined) {
+      return tenable_host_urls
+        .split(',')
+        .map((url) => url.trim())
+        .filter((url) => url.length > 0);
+    } else {
+      return [];
+    }
+  }
+
   getDatabaseName(): string {
     const databaseName = this.get('DATABASE_NAME');
     const nodeEnvironment = this.get('NODE_ENV');
@@ -91,8 +104,8 @@
         sslKey = this.get('DATABASE_SSL_KEY');
       } else {
         // Verify file exists
         if (fs.statSync(this.get('DATABASE_SSL_KEY')!).isFile()) {
           sslKey = fs.readFileSync(this.get('DATABASE_SSL_KEY')!);
         } else {
           throw new Error('SSL Key file does not exist');
         }
@@ -104,8 +117,8 @@
         sslCert = this.get('DATABASE_SSL_CERT');
       } else {
         // Verify file exists
         if (fs.statSync(this.get('DATABASE_SSL_CERT')!).isFile()) {
           sslCert = fs.readFileSync(this.get('DATABASE_SSL_CERT')!);
         } else {
           throw new Error('SSL Cert file does not exist');
         }
@@ -117,8 +130,8 @@
         sslCA = this.get('DATABASE_SSL_CA');
       } else {
         // Verify file exists
         if (fs.statSync(this.get('DATABASE_SSL_CA')!).isFile()) {
           sslCA = fs.readFileSync(this.get('DATABASE_SSL_CA')!);
         } else {
           throw new Error('SSL CA file does not exist');
         }
@@ -162,7 +175,7 @@
       return false;
     } else {
       const pattern =
         /^(?:([^:\/?#\s]+):\/{2})?(?:([^@\/?#\s]+)@)?([^\/?#\s]+)?(?:\/([^?#\s]*))?(?:[?]([^#\s]+))?\S*$/;
       const matches = url.match(pattern);
 
       if (matches === null) {

apps/backend/src/config/config.service.ts

@@ -78,6 +78,10 @@ export class ConfigService {
     return this.appConfig.getTenableHostUrl();
   }
 
+  getTenableHostUrls(): string[] {
+    return this.appConfig.getTenableHostUrls();
+  }
+
   getDbConfig(): SequelizeOptions {
     return this.appConfig.getDbConfig();
   }

apps/backend/src/tenable/tenable.controller.ts

@@ -6,9 +6,12 @@
   Body,
   HttpException,
   HttpStatus,
-  All
+  All,
+  UseGuards
 } from '@nestjs/common';
 import {TenableService} from './tenable.service';
+import {JwtAuthGuard} from '../guards/jwt-auth.guard';
+import {ConfigService} from '../config/config.service';
 import axios from 'axios';
 import {Request, Response} from 'express';
 
@@ -30,8 +33,32 @@
 // It allows users to log in with their Tenable credentials and then proxies all subsequent requests
 // to the Tenable API, handling authentication via session storage.
 @Controller('api/tenable')
+@UseGuards(JwtAuthGuard)
 export class TenableController {
-  constructor(private readonly tenableService: TenableService) {}
+  constructor(
+    private readonly tenableService: TenableService,
+    private readonly configService: ConfigService
+  ) {}
+
+  // Confirms host_url's origin matches an entry in the TENABLE_HOST_URLS allowlist.
+  private isAllowedHostUrl(host_url: string): boolean {
+    const allowlist = this.configService.getTenableHostUrls();
+    if (allowlist.length === 0) {
+      return false;
+    }
+    try {
+      const requestedOrigin = new URL(host_url).origin;
+      return allowlist.some((allowed) => {
+        try {
+          return new URL(allowed).origin === requestedOrigin;
+        } catch {
+          return false;
+        }
+      });
+    } catch {
+      return false;
+    }
+  }
 
   @Post('login')
   /**
@@ -42,7 +69,7 @@
    * @returns An object indicating success and the authenticated user's data from Tenable.
    * @throws {HttpException} If any credentials are missing or if authentication fails.
    */
   async login(
     @Req() req: Request,
     @Body() body: {host_url: string; accesskey: string; secretkey: string}
   ) {
@@ -52,6 +79,17 @@
       throw new HttpException('Missing credentials', HttpStatus.BAD_REQUEST);
     }
 
+    if (!this.isAllowedHostUrl(host_url)) {
+      throw new HttpException(
+        {
+          status: HttpStatus.FORBIDDEN,
+          message: 'Tenable host URL is not in the configured allowlist',
+          code: 'HOST_NOT_ALLOWED'
+        },
+        HttpStatus.FORBIDDEN
+      );
+    }
+
     try {
       // This helps prevent double slashes in the resulting URL if host_url ends with a slash.
       const fullUrl = `${host_url.replace(/\/$/, '')}/rest/currentUser`;

apps/backend/src/tenable/tenable.module.ts

@@ -1,6 +1,7 @@
 import {Module} from '@nestjs/common';
 import {TenableController} from './tenable.controller';
 import {TenableService} from './tenable.service';
+import {ConfigService} from '../config/config.service';
 
 // NestJS module definition for the Tenable proxy feature.
 // Registers the controller and service needed for routing Tenable requests.
@@ -9,6 +10,6 @@ import {TenableService} from './tenable.service';
   // Handles HTTP requests related to Tenable
   controllers: [TenableController],
   // Provides logic for proxying and interacting with Tenable API
-  providers: [TenableService]
+  providers: [TenableService, ConfigService]
 })
 export class TenableModule {}