TCP Web

Port 8443 (HTTPS Alt)

Learn about port 8443 (HTTPS Alt) - security risks, vulnerabilities, and common uses. Find devices with port 8443 open.

Quick Info

Port Number

8443

Protocol

TCP

Service

HTTPS Alt

IANA Name

HTTPS Alt

Service Description

TCP port 8443 is commonly used as an alternative port for HTTPS (Hypertext Transfer Protocol Secure) traffic. HTTPS, the secure version of HTTP, encrypts communication between a web browser and a web server using TLS/SSL, ensuring data confidentiality and integrity. While the standard HTTPS port is 443, using 8443 allows administrators to run HTTPS services alongside other services that might already be using port 443, or to avoid conflicts with firewalls or network configurations that restrict access to standard ports. This is particularly useful in development, testing, or internal environments where strict adherence to standard ports isn't always required.

At a technical level, when a client connects to a server on port 8443, the server initiates a TLS/SSL handshake. This involves exchanging cryptographic keys and certificates to establish a secure, encrypted channel. Once the secure connection is established, the client and server communicate using HTTP over this encrypted channel. The server must be configured to listen on port 8443 for incoming connections and possess a valid SSL/TLS certificate for the domain or IP address it serves. The client (typically a web browser) must be explicitly instructed to connect to the server using port 8443, usually by specifying the port in the URL (e.g., `https://example.com:8443`). The underlying protocol remains the same as HTTPS on port 443; only the port number differs.

## Firewall Recommendations

Whether to allow or block port 8443 depends on the specific services running on it and the security posture of the network. If a legitimate HTTPS service is intentionally configured to use port 8443, the port should be allowed through the firewall to permit access from authorized clients. However, it's crucial to implement strict access controls, allowing only necessary IP addresses or networks to connect. If no legitimate service requires port 8443, it should be blocked to prevent unauthorized access and potential exploitation. Regularly scan the network for services listening on non-standard ports like 8443 to identify any unauthorized or misconfigured applications. Always ensure that any HTTPS service running on port 8443 uses strong TLS/SSL configurations, including up-to-date ciphers and valid certificates, and keep the underlying software patched against known vulnerabilities. Implement intrusion detection and prevention systems (IDS/IPS) to monitor traffic on this port for suspicious activity.

Security Information

While using port 8443 doesn't inherently introduce new security risks compared to standard HTTPS on port 443, it can be targeted by attackers if not properly secured. A common vulnerability arises from misconfiguration, such as using weak TLS/SSL ciphers or self-signed certificates. Attackers may also target this port to exploit known vulnerabilities in the underlying applications or services running on it. Because it is a non-standard port, it may be overlooked during security audits, leading to unpatched software or weak configurations. Furthermore, if the service running on port 8443 handles sensitive data or authentication credentials, it becomes a prime target for man-in-the-middle attacks or credential stuffing attacks if the TLS/SSL implementation is flawed or outdated.

Known Vulnerabilities

CVE	Name	Severity	Description
CVE-2023-46604	Apache ActiveMQ Remote Code Execution	Critical	Apache ActiveMQ versions 5.15.0 through 5.18.3, 6.0.0 through 6.3.0, and 5.18.4 are vulnerable to remote code execution due to improper handling of serialized classes in the OpenWire protocol. If an ActiveMQ broker is accessible on port 8443 (or any other port), an attacker could exploit this vulnerability to execute arbitrary code on the server.
CVE-2021-44228	Log4Shell	Critical	A critical vulnerability in Apache Log4j 2 could allow remote code execution. While not specific to port 8443, any application using Log4j and exposed on this port could be vulnerable.
CVE-2017-5638	Apache Struts Remote Code Execution	Critical	A vulnerability in Apache Struts could allow remote code execution. While not specific to port 8443, any application using Struts and exposed on this port could be vulnerable.
CVE-2017-1000367	Jenkins Remote Code Execution	Critical	A vulnerability in Jenkins could allow remote code execution. If Jenkins is running on port 8443 and accessible, it could be vulnerable.
CVE-2023-22518	Atlassian Confluence Server and Data Center Improper Authorization Vulnerability	Critical	An Improper Authorization vulnerability in Atlassian Confluence Server and Data Center products allows unauthenticated attackers to bypass authentication and gain access to Confluence instances. While not specific to port 8443, if Confluence is accessible on this port, it is susceptible to exploitation.