Port 8443 (TCP) – Alternative HTTPS Port

Why It’s Open

Port 8443 is frequently utilized as an alternative to the standard HTTPS port (443) for secure web traffic. It’s commonly used by:

• Web Applications: Frameworks like Apache Tomcat often default to this port for SSL/TLS connections.
• Administrative Consoles: Tools such as Plesk, VMware vSphere, and SonicWall management interfaces use port 8443 for secure admin access.
• Development Environments: Developers may run applications on port 8443 to avoid conflicts with other services.

Using port 8443 allows multiple services to run concurrently on a single server without port conflicts.

Common Risks

Exposing port 8443 to untrusted networks can introduce several security risks:

• Unauthorized Access: If administrative interfaces are accessible without proper authentication, attackers can gain control over the application or server.
• Information Disclosure: Misconfigured services may leak sensitive information through error messages or debug interfaces.
• Exploitation of Vulnerabilities: Services listening on port 8443 may have unpatched vulnerabilities that attackers can exploit.
• Man-in-the-Middle (MitM) Attacks: Without proper SSL/TLS configuration, encrypted traffic can be intercepted or altered.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

Enumeration & Testing

Check if it’s open

nmap -sT -p 8443

Service Detection

nmap -sV -p 8443

SSL Certificate Analysis

openssl s_client -connect :8443

Web Application Scanning:

Use tools like Nikto or OWASP ZAP to identify potential vulnerabilities.

Known CVEs and Exploits

Here are some notable vulnerabilities associated with services running on port 8443:

• CVE-2023-38035: Ivanti Sentry System Manager Portal RCE vulnerability.
• CVE-2025-23006: SonicWall SMA1000 Appliance Management Console pre-authentication RCE.
• CVE-2021-22002: VMware Workspace ONE Access and Identity Manager host header manipulation vulnerability.
• CVE-2021-38507: Mozilla Firefox and Thunderbird HTTP/2 opportunistic encryption vulnerability affecting port 8443.

What to Look For

Mitigation

• Restrict Access: Use firewalls to limit access to port 8443 from trusted IP addresses only.
• Enforce Strong Authentication: Implement multi-factor authentication for administrative interfaces.
• Regularly Update Software: Keep all services and applications up to date with the latest security patches.
• Use Valid SSL/TLS Certificates: Ensure certificates are issued by trusted Certificate Authorities and are not expired.
• Disable Unnecessary Services: If port 8443 is not needed, close it to reduce the attack surface.

Real World Example

In 2023, a critical vulnerability (CVE-2023-38035) was discovered in Ivanti Sentry’s System Manager Portal, which listens on port 8443. This vulnerability allowed unauthenticated attackers to execute arbitrary commands on the server. Exploitation was possible through specific API endpoints, emphasizing the importance of securing services on this port. 

TL;DR

• Port 8443 is commonly used for secure web services and administrative interfaces.
• Risks include unauthorized access, information disclosure, and exploitation of vulnerabilities.
• Mitigation involves restricting access, enforcing strong authentication, keeping software updated, and using valid SSL/TLS certificates.
• Stay Informed: Regularly monitor for new vulnerabilities associated with services running on port 8443.