Description

In MITRE SAF Heimdall 2.11.6 through 2.13.x before 2.14.0, an SSRF issue allows remote attackers to access internal network resources via the Tenable proxy endpoint. This occurs in apps/backend/src/tenable/tenable.controller.ts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.8",
  "pubDate": "2026-08-29T15:17:55.317Z",
  "pubdate": "2026-08-29T15:17:55.317Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in MITRE SAF Heimdall versions 2.11.6 through 2.13.x, specifically prior to version 2.14.0. The vulnerability resides within the Tenable proxy integration, allowing an unauthorized remote attacker to coerce the application into making arbitrary HTTP requests to internal network resources.\nThe vulnerability occurs due to improper validation of user-supplied input utilized within the Tenable proxy endpoint. By exploiting this flaw, an attacker can bypass network perimeters, potentially interacting with services restricted to the internal network, such as metadata services, internal APIs, or databases not intended for public access.\nThe risk implication is significant as it grants attackers the ability to probe internal network topography, exfiltrate sensitive configuration data, or perform unauthorized actions against internal infrastructure. No authentication is explicitly required to trigger the request, making it accessible to any remote entity capable of reaching the application's Tenable proxy endpoint.\nThis vulnerability highlights a critical failure in input sanitization and proxy request verification. Immediate remediation is required via updating to version 2.14.0 or higher to implement appropriate request filtering and input validation controls.",
  "technicalDetails": "The vulnerability is localized within the Tenable proxy logic located at apps/backend/src/tenable/tenable.controller.ts. Analysis indicates that the application fails to adequately validate or restrict the target URL parameters passed to the Tenable proxy service before executing the outbound request. Consequently, the backend server acts as an open proxy, permitting the submission of arbitrary URIs.\nThe attack flow begins when an attacker sends a crafted request to the Tenable proxy endpoint. The vulnerable controller processes the user-provided input, which defines the destination address for the outgoing proxy request. Because the server does not perform sufficient validation against a whitelist of allowed domains or IP addresses—or perform blacklisting of internal/loopback address ranges—the application initiates an HTTP request to the attacker-defined destination.\nThis behavior allows the attacker to reach endpoints within the server's internal network that are shielded from direct internet access. For instance, an attacker could target 'http://127.0.0.1' or 'http://169.254.169.254' (in cloud environments) to retrieve sensitive configuration data, environment variables, or administrative interfaces. The proxy component essentially masquerades as a legitimate internal client, bypassing standard network firewalls and ingress filtering rules.\nThe exploitation process does not appear to require authentication, as the endpoint is exposed through the application's controller logic. When the application processes the request, the underlying library used for the outbound request retrieves the content from the malicious target and potentially reflects the response back to the attacker, or performs actions based on the returned data. This facilitates reconnaissance, data exfiltration, and potential lateral movement within the hosting environment.\nThe vulnerable code path in apps/backend/src/tenable/tenable.controller.ts facilitates this by improperly trustfully passing user-supplied input to internal network request functions. The scope of the vulnerability includes all versions from 2.11.6 up to, but not including, 2.14.0. The lack of robust URL sanitization and the absence of a restrictive allow-list mechanism for outbound requests are the root causes facilitating this SSRF primitive.\nPost-exploitation, an attacker can leverage this primitive to chain vulnerabilities, targeting internal services that might possess their own weaknesses or sensitive endpoints, significantly broadening the attack surface of the internal infrastructure managed by the MITRE SAF Heimdall installation."
}