Adjust Tenable integration by requiring auth and validating host URLs

apps/backend/.env-example

@@ -41,6 +41,7 @@ NGINX_HOST=<Templated out as the 'server_name' for the NGINX configuration (no d
 ## External interfaces 
 SPLUNK_HOST_URL=<The full Uniform Resource Locator (URL) without the port for the Splunk host (no default, must be set if connecting to Splunk)>
 TENABLE_HOST_URL=<The full Uniform Resource Locator (URL) without the port for the Tenable.SC host (no default, must be set if connecting to Tenable)>
+TENABLE_HOST_URLS=<Comma-separated allowlist of full Tenable.SC host URLs permitted for login (e.g. https://a.example.com,https://b.example.com). Client-supplied host_url values not in this list are rejected>
 
 # Authentication
 

apps/backend/config/app_config.ts

@@ -27,11 +27,11 @@
   }
 
   set(key: string, value: string | undefined): void {
     this.envConfig[key] = value;
   }
 
   get(key: string): string | undefined {
     return process.env[key] || this.envConfig[key];
   }
 
   getExternalUrl(): string {
@@ -61,6 +61,23 @@
     }
   }
 
+  // Comma-separated allowlist of Tenable.SC hosts permitted for the login/proxy endpoints.
+  // Falls back to (and merges with) the single-value TENABLE_HOST_URL for backward compatibility.
+  getTenableHostUrls(): string[] {
+    const tenable_host_urls = this.get('TENABLE_HOST_URLS');
+    const list = tenable_host_urls
+      ? tenable_host_urls
+          .split(',')
+          .map((url) => url.trim())
+          .filter((url) => url.length > 0)
+      : [];
+    const singleHostUrl = this.getTenableHostUrl();
+    if (singleHostUrl && !list.includes(singleHostUrl)) {
+      list.push(singleHostUrl);
+    }
+    return list;
+  }
+
   getDatabaseName(): string {
     const databaseName = this.get('DATABASE_NAME');
     const nodeEnvironment = this.get('NODE_ENV');
@@ -91,8 +108,8 @@
         sslKey = this.get('DATABASE_SSL_KEY');
       } else {
         // Verify file exists
         if (fs.statSync(this.get('DATABASE_SSL_KEY')!).isFile()) {
           sslKey = fs.readFileSync(this.get('DATABASE_SSL_KEY')!);
         } else {
           throw new Error('SSL Key file does not exist');
         }
@@ -104,8 +121,8 @@
         sslCert = this.get('DATABASE_SSL_CERT');
       } else {
         // Verify file exists
         if (fs.statSync(this.get('DATABASE_SSL_CERT')!).isFile()) {
           sslCert = fs.readFileSync(this.get('DATABASE_SSL_CERT')!);
         } else {
           throw new Error('SSL Cert file does not exist');
         }
@@ -117,8 +134,8 @@
         sslCA = this.get('DATABASE_SSL_CA');
       } else {
         // Verify file exists
         if (fs.statSync(this.get('DATABASE_SSL_CA')!).isFile()) {
           sslCA = fs.readFileSync(this.get('DATABASE_SSL_CA')!);
         } else {
           throw new Error('SSL CA file does not exist');
         }
@@ -162,7 +179,7 @@
       return false;
     } else {
       const pattern =
         /^(?:([^:\/?#\s]+):\/{2})?(?:([^@\/?#\s]+)@)?([^\/?#\s]+)?(?:\/([^?#\s]*))?(?:[?]([^#\s]+))?\S*$/;
       const matches = url.match(pattern);
 
       if (matches === null) {

apps/backend/src/config/config.service.ts

@@ -78,6 +78,10 @@ export class ConfigService {
     return this.appConfig.getTenableHostUrl();
   }
 
+  getTenableHostUrls(): string[] {
+    return this.appConfig.getTenableHostUrls();
+  }
+
   getDbConfig(): SequelizeOptions {
     return this.appConfig.getDbConfig();
   }

apps/backend/src/tenable/tenable.controller.ts

@@ -6,9 +6,12 @@
   Body,
   HttpException,
   HttpStatus,
-  All
+  All,
+  UseGuards
 } from '@nestjs/common';
 import {TenableService} from './tenable.service';
+import {JwtAuthGuard} from '../guards/jwt-auth.guard';
+import {ConfigService} from '../config/config.service';
 import axios from 'axios';
 import {Request, Response} from 'express';
 
@@ -30,8 +33,66 @@
 // It allows users to log in with their Tenable credentials and then proxies all subsequent requests
 // to the Tenable API, handling authentication via session storage.
 @Controller('api/tenable')
+@UseGuards(JwtAuthGuard)
 export class TenableController {
-  constructor(private readonly tenableService: TenableService) {}
+  constructor(
+    private readonly tenableService: TenableService,
+    private readonly configService: ConfigService
+  ) {}
+
+  // Returns the matching allowlisted origin for host_url, or null if none match
+  // or if host_url carries a path/query/fragment beyond a bare origin.
+  private resolveAllowedHostUrl(host_url: string): string | null {
+    const allowlist = this.configService.getTenableHostUrls();
+    if (allowlist.length === 0) {
+      return null;
+    }
+    // Default to https when no scheme is provided, so "example.com" is treated
+    // the same as "https://example.com".
+    const trimmedInput = host_url.trim();
+    const normalizedInput = /^[a-z][a-z\d+.-]*:\/\//i.test(trimmedInput)
+      ? trimmedInput
+      : `https://${trimmedInput}`;
+    try {
+      // Throws for unparseable input, caught below and treated as not allowed.
+      const parsed = new URL(normalizedInput);
+
+      // Reject any scheme other than http/https (e.g. file:, javascript:, ftp:).
+      if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        return null;
+      }
+
+      // Reject anything beyond a bare origin rather than silently stripping it,
+      // so a tampered/malformed host_url fails loudly instead of being sanitized.
+      const hasExtra =
+        (parsed.pathname !== '' && parsed.pathname !== '/') ||
+        parsed.search !== '' ||
+        parsed.hash !== '';
+      if (hasExtra) {
+        return null;
+      }
+
+      // Compare origins (scheme + host + port) rather than raw strings so that
+      // equivalent URLs (default ports, trailing slash, casing) still match.
+      const match = allowlist.find((allowed) => {
+        const trimmedAllowed = allowed.trim();
+        const normalizedAllowed = /^[a-z][a-z\d+.-]*:\/\//i.test(trimmedAllowed)
+          ? trimmedAllowed
+          : `https://${trimmedAllowed}`;
+        try {
+          return new URL(normalizedAllowed).origin === parsed.origin;
+        } catch {
+          return false;
+        }
+      });
+
+      // Return the parsed origin (never the raw client value) so nothing beyond
+      // scheme+host+port ever propagates into the session or outbound requests.
+      return match ? parsed.origin : null;
+    } catch {
+      return null;
+    }
+  }
 
   @Post('login')
   /**
@@ -42,7 +103,7 @@
    * @returns An object indicating success and the authenticated user's data from Tenable.
    * @throws {HttpException} If any credentials are missing or if authentication fails.
    */
   async login(
     @Req() req: Request,
     @Body() body: {host_url: string; accesskey: string; secretkey: string}
   ) {
@@ -52,17 +113,29 @@
       throw new HttpException('Missing credentials', HttpStatus.BAD_REQUEST);
     }
 
+    const allowedHostUrl = this.resolveAllowedHostUrl(host_url);
+    if (!allowedHostUrl) {
+      throw new HttpException(
+        {
+          status: HttpStatus.FORBIDDEN,
+          message: 'Tenable host URL is not in the configured allowlist',
+          code: 'HOST_NOT_ALLOWED'
+        },
+        HttpStatus.FORBIDDEN
+      );
+    }
+
     try {
-      // This helps prevent double slashes in the resulting URL if host_url ends with a slash.
-      const fullUrl = `${host_url.replace(/\/$/, '')}/rest/currentUser`;
+      // allowedHostUrl is the parsed origin, so no trailing slash to strip.
+      const fullUrl = `${allowedHostUrl}/rest/currentUser`;
       const result = await axios.get(fullUrl, {
         headers: {
           'x-apikey': `accesskey=${accesskey}; secretkey=${secretkey}`
         }
       });
 
-      // Assign the Tenable credentials to the session
-      req.session.tenable = {host_url, accesskey, secretkey};
+      // Store the normalized, allowlisted origin rather than the raw client value.
+      req.session.tenable = {host_url: allowedHostUrl, accesskey, secretkey};
 
       // Return the authenticated user data
       // Note: result.data is already a plain object, no need to convert it.

apps/backend/src/tenable/tenable.module.ts

@@ -1,11 +1,13 @@
 import {Module} from '@nestjs/common';
 import {TenableController} from './tenable.controller';
 import {TenableService} from './tenable.service';
+import {ConfigModule} from '../config/config.module';
 
 // NestJS module definition for the Tenable proxy feature.
 // Registers the controller and service needed for routing Tenable requests.
 
 @Module({
+  imports: [ConfigModule],
   // Handles HTTP requests related to Tenable
   controllers: [TenableController],
   // Provides logic for proxying and interacting with Tenable API