Skip to main content
protocols.pageprotocols.page
9000

Port 9000 – PHP-FPM / SonarQube

TCP

Port 9000 is shared by PHP-FPM (FastCGI process manager), SonarQube code quality platform, Portainer Docker management, and ClickHouse native protocol. Context determines the service. PHP-FPM on port 9000 should never be directly exposed – only Nginx/Apache should connect to it locally.

Port Number

9000

Protocol

TCP

Service

PHP-FPM / SonarQube / Portainer

Range

IANA Registered (1024–49151)

Description

Port 9000 is one of the most overloaded ports in modern infrastructure. PHP-FPM listens on TCP 9000 for FastCGI connections from web servers. SonarQube serves its code analysis web UI on port 9000. Portainer (Docker management) defaults to port 9000. ClickHouse native protocol uses port 9000. For PHP-FPM: exposing port 9000 externally allows attackers to send arbitrary FastCGI requests, potentially executing PHP code without going through the web server's access controls. Bind PHP-FPM to a Unix socket or 127.0.0.1:9000 only. For SonarQube/Portainer: these are management interfaces with full administrative access – restrict to internal networks and enable authentication.

Security risks

  • 1CVE-2019-11043: PHP-FPM + nginx path_info RCE – specific nginx configurations allow remote code execution via crafted URLs to port 9000. Actively exploited in the wild. CVSS 9.8
  • 2CVE-2024-2961: PHP-FPM iconv buffer overflow enabling RCE via heap manipulation – affects all PHP-FPM instances on port 9000 running PHP 8.x before 8.3.8
  • 3SonarQube on port 9000 ships with no authentication by default – unauthenticated access exposes all source code, security hotspots, and vulnerability findings across all projects
  • 4Portainer on port 9000 provides full Docker API access – container escape, host filesystem access, and arbitrary container creation from the web UI
  • 5Direct PHP-FPM exposure on port 9000 allows crafting FastCGI requests that bypass web server access controls, .htaccess rules, and authentication entirely
  • 6ClickHouse native protocol on port 9000 has no authentication by default – full database read/write/admin access from any connecting client
  • 7CVE-2023-4911 (Looney Tunables): glibc ld.so buffer overflow exploitable through PHP-FPM worker processes on port 9000 for local privilege escalation

Firewall guidance

PHP-FPM: NEVER expose port 9000 externally – bind to Unix socket (preferred) or 127.0.0.1:9000. Only nginx/Apache on the same host should connect. SonarQube: enable authentication immediately (sonar.forceAuthentication=true), restrict to developer network, place behind reverse proxy with SSO. Portainer: bind to 127.0.0.1 and access via SSH tunnel or VPN only. ClickHouse: enable password authentication and restrict port 9000 to application server IPs.

Diagnosis commands

Identify which service owns port 9000 – critical first step since PHP-FPM, SonarQube, Portainer, and ClickHouse all compete for this port

shell
ss -tlnp | grep 9000

Test PHP-FPM FastCGI connectivity directly – if this works from an external host, PHP-FPM is dangerously exposed

shell
cgi-fcgi -bind -connect 127.0.0.1:9000

Check SonarQube status and version (if SonarQube is on port 9000) – also test if authentication is enforced

shell
curl -s http://localhost:9000/api/system/status

Verify SonarQube authentication is enforced – critical security check

shell
curl -s http://localhost:9000/api/settings/values?keys=sonar.forceAuthentication

Validate PHP-FPM configuration and check listen directive (should be socket or 127.0.0.1:9000)

shell
php-fpm -t && php-fpm -i | grep listen

Test ClickHouse native port authentication – if this succeeds without credentials, auth is disabled

shell
clickhouse-client --port 9000 --query 'SELECT currentUser()'

Usage examples

Port 9000 – PHP-FPM / SonarQube
shell
php-fpm.conf: listen = 127.0.0.1:9000
nginx: fastcgi_pass 127.0.0.1:9000;
docker run -p 9000:9000 portainer/portainer-ce

Common services on this port

PHP-FPM (FastCGI Process Manager)SonarQube (code quality / SAST platform)Portainer (Docker management UI)ClickHouse native protocol (column-store OLAP)MinIO S3 API (object storage)Play Framework (Scala/Java web apps)

Related ports

9003

PHP Xdebug (debug protocol)

9001

Portainer alternate / Supervisord

9090

SonarQube (alternate config)

8123

ClickHouse HTTP interface

443

SonarCloud (hosted)

History

Port 9000 became one of the most contested ports in modern infrastructure through independent adoption by multiple projects. PHP-FPM claimed it first (2004) as the FastCGI listen port, inheriting from spawn-fcgi conventions. SonarQube (originally Sonar, 2007) chose port 9000 for its web UI. Portainer (2016) used port 9000 for Docker management. ClickHouse (2016, Yandex) adopted port 9000 for its native binary protocol. CVE-2019-11043 made port 9000 infamous – a specific nginx + PHP-FPM configuration allowed trivial RCE via URL manipulation, affecting millions of WordPress, Laravel, and Drupal installations. The vulnerability was actively mass-exploited within hours of disclosure.

FAQ

How do I check if my PHP-FPM on port 9000 is vulnerable to CVE-2019-11043?

The vulnerability requires: 1) nginx with fastcgi_split_path_info directive, 2) try_files that falls through to PHP-FPM, 3) PATH_INFO passed to PHP-FPM without length check. Test: send a URL like /index.php/path%0Ainfo to your nginx. If PHP-FPM processes it, you're vulnerable. Fix: upgrade PHP to 7.3.11+ / 7.2.24+, or change nginx config to validate path_info before passing to FPM.

How do I determine which service is using port 9000?

Run: ss -tlnp | grep :9000. The process name tells you: 'php-fpm' = PHP-FPM, 'java' with SonarQube in cmdline = SonarQube, 'portainer' = Portainer, 'clickhouse' = ClickHouse. If migrating services, change the port in: php-fpm.conf (listen = ...), sonar.properties (sonar.web.port=), portainer CLI (--addr :XXXX), or clickhouse config.xml (tcp_port).

Should I use a Unix socket instead of TCP port 9000 for PHP-FPM?

Yes, always prefer Unix sockets for PHP-FPM when nginx/Apache is on the same host. Sockets are: 1) ~5-15% faster (no TCP overhead), 2) impossible to expose externally (filesystem permissions only), 3) auditable via file ownership. Configure: listen = /var/run/php-fpm.sock in pool.conf, and fastcgi_pass unix:/var/run/php-fpm.sock in nginx. TCP port 9000 is only needed for remote PHP-FPM (rare, requires SSH tunnel).