iSCSI Unauthenticated Target Detection

Tenable plugin 51368 is a configuration finding, not a CVE. It fires when the scanner speaks iSCSI to a target on TCP/3260 and the target accepts a login without demanding CHAP authentication. iSCSI is the protocol that carries raw SCSI block commands over TCP — the same commands your hypervisor or database uses to read/write disk sectors on a SAN. Any initiator that can reach the portal can enumerate targets via SendTargets, log in, and mount the LUN as a local block device. Affected 'versions' aren't a software range — this is a misconfiguration in the target daemon (Linux tgtd/LIO, Windows Server iSCSI Target, NetApp, Dell EMC, Synology, QNAP, TrueNAS, HPE, etc.). Anything speaking RFC 3720/7143 that omits CHAP AuthMethod is in scope.

Vendor severity HIGH is fair, and arguably conservative. The finding has no CVSS attached because it's a config issue, but the impact model matches an unauthenticated remote data-plane exposure: read/write access to the entire LUN, which frequently backs VMware datastores, Hyper-V CSVs, SQL/Oracle data files, or Veeam/Rubrik backup repositories. Whether it stays HIGH or floats to CRITICAL depends entirely on what the LUN is holding and who can reach port 3260 — and in most shops the storage VLAN is far more porous than the storage team believes.

Why this verdict

• Role multiplier — canonical high-value tier: iSCSI targets almost never back low-value roles. The LUN carries VMware datastores, SQL/Oracle data files, Exchange DBs, or Veeam/Rubrik repositories. A successful chain reads or destroys the workload's disk beneath the OS — bypassing EDR, DLP, and application ACLs entirely.
• Zero exploitation cost: the 'exploit' is running iscsiadm --login. No memory corruption, no auth bypass logic, no version-specific offsets. Any Linux workstation or WSL install becomes a weaponized initiator in under 60 seconds.
• Friction floor — internal reachability: in reasonably segmented shops the portal lives on a storage VLAN with no client route, which is what keeps this from being CRITICAL. But 'internal only' means a compromised jump host, hypervisor management interface, or backup admin workstation gets there, and flat-network mid-market shops expose it far more broadly.
• Detection asymmetry: hypervisor-side tooling is blind to a rogue initiator's session because the read/write happens at the array. You are relying on the storage admin noticing an unfamiliar IQN in the session table, which almost never happens.
• No patch, only configuration: unlike a CVE, this doesn't age out with a version bump. It remains true until someone flips CHAP on and audits ACLs — a deliberate act.

Why not higher?

Not CRITICAL because the overwhelming majority of iSCSI portals are not directly internet-reachable — Shodan's ~15–20k global exposure is a rounding error against the installed base. The chain requires the attacker to already be inside a network segment that routes to the storage VLAN, which is a real (if often weak) barrier.

Why not lower?

Not MEDIUM because when the chain lands, the outcome is unauthenticated read/write on a LUN that typically holds hypervisor datastores or database files. The friction is one-VLAN-hop of network reachability, not multiple compromise stages, and no user interaction, credential theft, or memory-corruption reliability engineering is involved.

1. Enable mutual CHAP on discovery and session phases — On the target, require AuthMethod=CHAP for both discovery and normal sessions and configure a strong shared secret. On Linux targetcli, set set auth userid=... password=... per ACL. On Windows iSCSI Target Server, set CHAP under target properties. Deploy within 30 days per noisgate mitigation SLA.
2. Enforce initiator IQN + source-IP ACLs — IQN alone is spoofable; pair it with an IP allowlist limited to your hypervisor and DB hosts. On NetApp use igroup with initiator and os_type bindings; on Dell EMC use Host Access; on Linux LIO use acls/ with mapped_luns. Do this alongside CHAP, not instead of.
3. Isolate iSCSI onto a dedicated non-routed storage VLAN — Storage traffic should never share broadcast domains with user or DMZ networks. Bind the portal to a dedicated NIC on a VLAN with no default gateway. Confirm with traceroute from a user segment — you should get 'no route to host'.
4. Block TCP/3260 egress from user, DMZ, and jump segments at the NGFW — Even if segmentation is imperfect, an explicit deny on 3260 from anything that isn't a hypervisor or DB host closes the reachability precondition. Log denied attempts and alert.
5. Enable IPsec for iSCSI (RFC 7146) on high-sensitivity fabrics — For regulated workloads (PCI, HIPAA) or when the storage VLAN traverses shared switches, IPsec transport mode between initiator and target authenticates the peer and encrypts SCSI PDUs, defeating both spoofing and passive capture.
6. Alert on new iSCSI sessions from unexpected IQNs/IPs — Ship target session logs (Linux /var/log/messages, Windows Microsoft-Windows-iSCSI-Target/Operational) to the SIEM. Detection rule: session login where source IP is not in the hypervisor/DB allowlist.

Run this from an auditor workstation on the same segment as the storage portal (or the storage VLAN via a jump host). Requires open-iscsi installed and root for the discovery calls. Invoke as: sudo ./check_iscsi_auth.sh 10.20.30.40 where the argument is the target portal IP. Outputs VULNERABLE / PATCHED / UNKNOWN.

#!/usr/bin/env bash
# noisgate: iSCSI Unauthenticated Target check (Tenable 51368)
# Usage: sudo ./check_iscsi_auth.sh <portal_ip> [port]
set -u
TARGET="${1:-}"
PORT="${2:-3260}"
if [[ -z "$TARGET" ]]; then echo "usage: $0 <portal_ip> [port]"; exit 2; fi
if ! command -v iscsiadm >/dev/null 2>&1; then echo "UNKNOWN: open-iscsi/iscsiadm not installed"; exit 3; fi
if [[ $EUID -ne 0 ]]; then echo "UNKNOWN: must run as root"; exit 3; fi

# 1. Is the portal reachable?
if ! timeout 5 bash -c "</dev/tcp/${TARGET}/${PORT}" 2>/dev/null; then
  echo "UNKNOWN: TCP/${PORT} unreachable on ${TARGET}"; exit 3
fi

# 2. Ensure discovery-phase CHAP is OFF on our initiator so we exercise the target's requirement
sed -i 's/^discovery.sendtargets.auth.authmethod.*/discovery.sendtargets.auth.authmethod = None/' /etc/iscsi/iscsid.conf 2>/dev/null || true
systemctl restart iscsid 2>/dev/null || service iscsid restart 2>/dev/null || true

# 3. Attempt anonymous SendTargets discovery
DISC=$(timeout 10 iscsiadm -m discovery -t sendtargets -p "${TARGET}:${PORT}" 2>&1)
RC=$?
if [[ $RC -ne 0 ]]; then
  if echo "$DISC" | grep -qiE 'auth|chap|permission|forbidden|reject'; then
    echo "PATCHED: portal requires authentication for discovery"; exit 0
  fi
  echo "UNKNOWN: discovery failed rc=$RC msg=$DISC"; exit 3
fi

IQNS=$(echo "$DISC" | awk '{print $2}' | grep -E '^iqn\.' | sort -u)
if [[ -z "$IQNS" ]]; then echo "UNKNOWN: no IQNs returned"; exit 3; fi

# 4. Try a non-persistent normal-session login to the first target
FIRST=$(echo "$IQNS" | head -1)
LOGIN=$(timeout 10 iscsiadm -m node -T "$FIRST" -p "${TARGET}:${PORT}" --login 2>&1)
LRC=$?
if [[ $LRC -eq 0 ]]; then
  echo "VULNERABLE: unauthenticated session established to ${FIRST} on ${TARGET}"
  iscsiadm -m node -T "$FIRST" -p "${TARGET}:${PORT}" --logout >/dev/null 2>&1
  iscsiadm -m node -T "$FIRST" -p "${TARGET}:${PORT}" -o delete >/dev/null 2>&1
  exit 1
fi
if echo "$LOGIN" | grep -qiE 'auth|chap|reject|forbidden'; then
  echo "PARTIAL: discovery unauthenticated but session-phase auth enforced on ${FIRST}"; exit 1
fi
echo "UNKNOWN: login rc=$LRC msg=$LOGIN"; exit 3

Sources

1. Tenable plugin 51368 — iSCSI Unauthenticated Target Detection
2. RFC 7143 — Internet Small Computer System Interface (iSCSI) Protocol
3. RFC 7146 — Securing Block Storage Protocols over IP: RFC 3723 Requirements Update for IPsec v3
4. Nmap NSE — iscsi-info script
5. Metasploit — iSCSI login scanner module
6. Linux open-iscsi initiator documentation
7. CISA / Mandiant M-Trends — ESXi/hypervisor-targeting ransomware trends
8. vmfs-tools — offline VMFS parsing