Skip to main content
protocols.pageprotocols.page
8009

Port 8009 – AJP / Tomcat

TCP

Port 8009 is the AJP (Apache JServ Protocol) connector port for Apache Tomcat. AJP is a binary protocol between a front-end web server (Apache httpd, Nginx) and Tomcat. Ghostcat (CVE-2020-1938) allowed reading arbitrary files via AJP – never expose port 8009 beyond localhost. Modern deployments use HTTP proxying instead.

Port Number

8009

Protocol

TCP

Service

Apache JServ Protocol

Range

IANA Registered (1024–49151)

Description

Apache JServ Protocol on port 8009 provides a binary, optimized communication channel between front-end web servers and Java application servers (Tomcat, JBoss, WildFly). AJP passes request headers, body, and SSL client certificate information more efficiently than HTTP proxying. The Ghostcat vulnerability (CVE-2020-1938) demonstrated that AJP on port 8009 without authentication allows attackers to read any file accessible to the Tomcat process and execute JSP code in some configurations. After Ghostcat, the default changed to bind AJP to localhost only. Modern best practice is to disable AJP entirely and use HTTP reverse proxying (mod_proxy_http, Nginx upstream) – the performance difference is negligible on modern hardware.

Security risks

  • 1CVE-2020-1938 Ghostcat (CVSS 9.8): CRITICAL – AJP protocol flaw allows unauthenticated attackers to read ANY file accessible to the Tomcat process including WEB-INF/web.xml (contains database credentials, API keys), source code (.java/.jsp), and configuration files. If file upload exists, attackers achieve RCE by uploading a .txt file and requesting it as a JSP via AJP. Affects ALL Tomcat versions before 9.0.31/8.5.51/7.0.100
  • 2AJP request smuggling: the AJP protocol trusts the front-end server to set request attributes (javax.servlet.include.*, remoteAddr). Without a proper front-end, an attacker directly connecting to 8009 can spoof the client IP, bypass IP-based access controls, and access restricted servlets
  • 3No authentication by design: AJP has no authentication mechanism – it assumes only a trusted reverse proxy connects. Any host reaching port 8009 has full proxy-level access to all Tomcat web applications
  • 4Credential theft via WEB-INF: Ghostcat reads WEB-INF/web.xml which typically contains <resource-ref> entries with JDBC URLs, usernames, and passwords for database connections. One read = full database compromise
  • 5JSP source code disclosure: requesting .jsp files via AJP with specific attributes returns the raw source code instead of executing it – reveals hardcoded secrets, internal APIs, and business logic

Firewall guidance

DISABLE AJP entirely unless you specifically use mod_jk or mod_proxy_ajp. In server.xml: remove or comment out the AJP Connector element. If AJP is required: bind to localhost only (address="127.0.0.1"), set requiredSecret="long-random-string" (Tomcat 9.0.31+), and ensure only the reverse proxy host can reach port 8009. Modern best practice: use mod_proxy_http instead of AJP – the performance difference is negligible.

Diagnosis commands

Check if AJP port is open (should be closed or filtered from external)

shell
nmap -sV -p 8009 target

Check if AJP connector is enabled in Tomcat config

shell
grep -i 'AJP\|8009' /opt/tomcat/conf/server.xml | grep -v '<!--'

Quick check if port 8009 accepts connections (any connection = potential Ghostcat)

shell
python3 -c "import socket; s=socket.socket(); s.settimeout(3); s.connect(('target',8009)); print('OPEN - VULNERABLE'); s.close()"

Verify AJP bind address and process (should be 127.0.0.1 or absent)

shell
ss -tlnp sport = :8009

Usage examples

Port 8009 – AJP / Tomcat
shell
curl --include http://localhost:8009/ # will fail – AJP is binary
nmap -sV -p 8009 target # detects AJP
server.xml: <Connector port='8009' protocol='AJP/1.3' address='127.0.0.1'/>

Common services on this port

Apache TomcatWildFly/JBoss (AJP)Apache httpd mod_jk/mod_proxy_ajpNginx AJP module (njet)IBM WebSphere (AJP compatibility)

Related ports

8080

Tomcat HTTP connector

8443

Tomcat HTTPS connector

80

Apache httpd (mod_jk front-end)

443

Apache/Nginx front-end (mod_proxy_ajp)

History

AJP (Apache JServ Protocol) was created in the late 1990s to connect Apache httpd to Java servlet containers more efficiently than CGI or HTTP proxying. AJP/1.3 (the version used since Tomcat 3.x) is a binary protocol that avoids re-parsing HTTP headers. Port 8009 was registered with IANA. Ghostcat (CVE-2020-1938, disclosed February 2020 by Chaitin Tech) was a 20-year-old design flaw – AJP was never meant to be accessible from untrusted networks, but the default binding to 0.0.0.0 made it exploitable on any Tomcat installation.

FAQ

Should I use AJP or HTTP proxying in 2024+?

HTTP proxying (mod_proxy_http, Nginx upstream). AJP was designed when HTTP/1.0 proxying was expensive – the binary format saved CPU on 1990s hardware. On modern servers, HTTP/1.1 proxying (with keep-alive) has negligible overhead compared to AJP, and avoids the entire Ghostcat attack surface. The only remaining AJP advantage: client certificate forwarding is simpler. For new deployments, disable AJP entirely.

How do I verify Ghostcat is patched?

Check Tomcat version (must be 9.0.31+/8.5.51+/7.0.100+). Even patched, AJP should NOT be externally accessible. Verify: nmap -p 8009 your-server-public-ip should return 'filtered' or 'closed'. If AJP is enabled, check server.xml for address="127.0.0.1" and secretRequired="true" (or secret="..." in older configs). Test exploit: use ajpShooter.py or YDHCUI's Ghostcat tool against your own server.