Port 8243 – WSO2 HTTPS

TCP

Port 8243 is the WSO2 API Manager and Enterprise Service Bus HTTPS transport port for API gateway traffic. WSO2 serves proxied API calls over TLS on port 8243 while the management console runs on port 9443. Restrict management ports and apply rate limiting on the gateway.

Port Number

8243

Protocol

TCP

Service

WSO2 API Manager / ESB HTTPS

Range

IANA Registered (1024–49151)

Description

WSO2 Carbon-based products (API Manager, Enterprise Integrator, Identity Server) use port 8243 as the HTTPS pass-through transport. API clients send requests to port 8243 which the gateway routes to backend services after applying authentication, rate limiting, and transformation policies. Port 8243 is the production traffic port – it should be accessible to API consumers. The management console (port 9443) and internal ports should be on separate network segments. Monitor port 8243 for unusual traffic patterns and ensure TLS certificates are valid and not self-signed for external APIs.

Security risks

1CVE-2022-29464 (CVSS 9.8): Unrestricted file upload in WSO2 products – unauthenticated attacker uploads arbitrary JSP webshells via /fileupload endpoint, achieving remote code execution. Actively exploited within days of disclosure (April 2022). Affects API Manager, Identity Server, Enterprise Integrator, and Open Banking.
2CVE-2021-42646: WSO2 API Manager XML External Entity (XXE) injection via SOAP API definitions – attacker reads internal files (/etc/passwd, carbon.xml with database credentials) through crafted DTD payloads in API imports.
3OAuth token theft via exposed /token endpoint: port 8243 serves OAuth2 token generation. Misconfigured CORS or missing rate limiting allows brute-force of client credentials. Stolen OAuth tokens grant full API access until expiry.
4TLS certificate misconfiguration: WSO2 ships with a default self-signed wso2carbon.jks keystore. Production deployments that forget to replace it have certificate warnings users learn to ignore, enabling MITM on the gateway.
5Backend service exposure: WSO2 API gateway proxies to backend services. SSRF vulnerabilities in API definitions can make the gateway reach internal services (databases, admin consoles) that clients should never access directly.

Firewall guidance

Port 8243 should be exposed to API consumers (internal or external) through a WAF or CDN (Cloudflare, AWS WAF). Never expose the management port 9443 on the same network path. Restrict /services/*, /fileupload, and admin endpoints via WAF rules. Rate-limit the /token endpoint (OAuth). Use a proper CA certificate – never the default wso2carbon keystore in production.

Diagnosis commands

Test API gateway HTTPS responsiveness and certificate

shell

curl -kI https://gateway:8243/services/echo

Verify TLS certificate is not the default wso2carbon cert

shell

openssl s_client -connect gateway:8243 -servername gateway </dev/null 2>&1 | grep -E '(subject|issuer|verify)'

Test OAuth2 token endpoint (should require valid credentials)

shell

curl -k https://gateway:8243/token -d 'grant_type=client_credentials' -u clientId:clientSecret

Audit TLS ciphers on the API gateway port

shell

nmap -sV -p 8243 --script ssl-enum-ciphers target

Usage examples

Port 8243 – WSO2 HTTPS

shell

curl https://gateway:8243/api/v1/resource -H 'Authorization: Bearer token'
wso2am: <transportReceiver name='https' port='8243'/>
openssl s_client -connect gateway:8243

Common services on this port

WSO2 API ManagerWSO2 Enterprise IntegratorWSO2 Identity ServerWSO2 Micro IntegratorWSO2 Open Banking

Related ports

9443

WSO2 Management Console (Carbon admin)

8280

WSO2 HTTP gateway (unencrypted)

9763

WSO2 Management HTTP (legacy)

443

HTTPS standard (production front)

History

WSO2 was founded in 2005 in Sri Lanka as an open-source middleware company. Port 8243 was chosen as the HTTPS pass-through transport port for the API Manager (first released 2012). The architecture separates gateway traffic (8243/8280) from management (9443/9763) to allow different firewall rules. CVE-2022-29464 was a watershed moment – CISA added it to the Known Exploited Vulnerabilities catalog within a week of disclosure, forcing emergency patches across thousands of WSO2 deployments.

FAQ

Port 8243 vs 9443 – what is the difference?

Port 8243 is the API gateway (handles production API traffic from consumers – OAuth tokens, API calls, rate limiting). Port 9443 is the Carbon management console (admin UI for publishing APIs, managing users, configuring policies). Never expose 9443 to API consumers. In production: 8243 faces the internet (through WAF), 9443 is internal/VPN-only.

How do I patch CVE-2022-29464?

Apply the WSO2 security update (WUM update or manual patch from wso2.com/security). If immediate patching is impossible: block /fileupload/* paths at the reverse proxy/WAF level. The vulnerability is unauthenticated – no credentials needed to exploit. Check for existing webshells: find /repository/deployment/server/webapps -name '*.jsp' -newer /bin/version.txt.

Should I put WSO2 behind a reverse proxy?

Yes, always. Deploy Nginx or AWS ALB in front of port 8243 to: terminate TLS (with proper CA cert), apply rate limiting, block admin paths, add WAF rules (OWASP CRS), and handle HTTP/2. WSO2's embedded Netty transport is capable but lacks the security middleware a dedicated proxy provides.