Skip to main content
protocols.pageprotocols.page
9001

Port 9001 – Supervisord / MinIO

TCP

Port 9001 is used by Supervisord (process manager XML-RPC), MinIO console (S3-compatible storage web UI), and ETH2 beacon nodes. Supervisord's XML-RPC on port 9001 allows starting/stopping processes – unauthenticated access enables arbitrary process control. MinIO console requires authentication but exposes bucket management.

Port Number

9001

Protocol

TCP

Service

Supervisor XML-RPC / MinIO Console

Range

IANA Registered (1024–49151)

Description

Port 9001 serves different services depending on context. Supervisord uses it for its XML-RPC interface and web UI (supervisorctl connects here). MinIO object storage runs its management console on port 9001 (separate from the S3 API on port 9000). Ethereum 2.0 beacon nodes also use port 9001 for P2P communication. Supervisord on port 9001 is particularly dangerous when exposed – the XML-RPC API allows starting, stopping, and restarting managed processes without authentication by default. An attacker can stop critical services or restart them with modified configurations. Always set [inet_http_server] username and password in supervisord.conf and bind to 127.0.0.1.

Security risks

  • 1CVE-2017-11610: Supervisord XML-RPC RCE on port 9001 – authenticated users can execute arbitrary OS commands via crafted XML-RPC requests to supervisor.supervisord.options.execve(). CVSS 8.8
  • 2Supervisord default configuration has no authentication on port 9001 – any network client can start, stop, restart, and tail logs of all managed processes
  • 3MinIO console on port 9001 exposes bucket management, user creation, and policy configuration – compromised access enables data exfiltration from all stored objects
  • 4CVE-2023-28432: MinIO information disclosure – environment variables (including MINIO_SECRET_KEY) leaked via the /minio/health/cluster endpoint accessible from port 9001
  • 5Supervisord's XML-RPC allows reading stdout/stderr logs of managed processes which may contain secrets, API keys, and database credentials logged by applications
  • 6ETH2 beacon node P2P on port 9001 – misconfigured firewalls may confuse MinIO/Supervisord traffic with legitimate blockchain P2P, bypassing security rules

Firewall guidance

Supervisord: bind to 127.0.0.1:9001 exclusively in supervisord.conf – remote management should use SSH tunnel + supervisorctl socket. ALWAYS set username/password even for local access (CVE-2017-11610 requires auth but default has none). MinIO: place console port 9001 behind reverse proxy with SSO/OIDC authentication. Never expose MinIO console to internet – use presigned URLs for external object access. Separate MinIO API (9000) from Console (9001) in firewall rules.

Diagnosis commands

Test Supervisord XML-RPC access – if this returns state without auth, the service is dangerously exposed

shell
curl -s http://localhost:9001/RPC2 -d '<?xml version="1.0"?><methodCall><methodName>supervisor.getState</methodName></methodCall>'

List all Supervisord-managed processes and their current state via XML-RPC on port 9001

shell
supervisorctl -s http://localhost:9001 status

Check MinIO console health endpoint – should not leak environment variables (patched in RELEASE.2023-03-20)

shell
curl -s http://localhost:9001/minio/health/live

Identify whether port 9001 is Supervisord (python), MinIO (minio), or beacon node – determines security context

shell
ss -tlnp | grep 9001

Audit Supervisord configuration for authentication and bind address – both must be set

shell
grep -n 'inet_http_server\|port\|username\|password' /etc/supervisor/supervisord.conf

Usage examples

Port 9001 – Supervisord / MinIO
shell
supervisord.conf: [inet_http_server] port=127.0.0.1:9001 username=admin password=pass
minio server /data --console-address :9001
supervisorctl -s http://localhost:9001 status

Common services on this port

Supervisord XML-RPC / Web UI (process manager)MinIO Console (S3-compatible storage management)Ethereum 2.0 beacon node P2P (Lighthouse, Prysm)Various development servers (Vite, webpack alternate)Tor relay ORPort (alternate configuration)

Related ports

9000

MinIO S3 API / Portainer

9002

MinIO Console (alternate)

4150

Supervisord event listener

9090

Prometheus (MinIO metrics)

13000

ETH2 Prysm beacon P2P (alternate)

History

Port 9001 has dual heritage. Supervisord adopted it circa 2004 as the default inet_http_server port for its XML-RPC process management interface – a design that predated container orchestration and assumed trusted networks. MinIO chose port 9001 for its web console in 2020 (separating console from the S3 API on 9000) during the transition from browser-based to standalone console. CVE-2017-11610 made Supervisord on port 9001 notorious – it demonstrated that even authenticated Supervisord users could achieve RCE through XML-RPC method traversal, affecting thousands of Docker containers and legacy Linux deployments that used Supervisord as init.

FAQ

How do I secure Supervisord on port 9001?

1) Set [inet_http_server] port=127.0.0.1:9001 (never 0.0.0.0). 2) Set username and password (even local-only, due to CVE-2017-11610 RCE path). 3) Upgrade to Supervisord 3.3.3+ which patches the XML-RPC traversal. 4) For remote access, use Unix socket + SSH: [unix_http_server] file=/var/run/supervisor.sock, then SSH tunnel. 5) Consider migrating to systemd for process management – it has no network listener attack surface.

Can I run both Supervisord and MinIO console on the same server?

Not on the same port. Change one: either set Supervisord to a different port ([inet_http_server] port=127.0.0.1:9002) or start MinIO with --console-address :9002. Both services on the same host is fine for development but in production, Supervisord should use Unix socket only (no TCP listener) and MinIO console should be behind a reverse proxy.

Is CVE-2017-11610 still exploitable today?

Yes, if running Supervisord < 3.3.3 with inet_http_server enabled. The exploit uses Python's nested attribute traversal in XML-RPC: supervisor.supervisord.options.warnings.linecache.os.system('COMMAND'). Patch: upgrade Supervisord. Mitigate: remove [inet_http_server] entirely and use Unix socket + supervisorctl. Docker images based on old base images frequently ship vulnerable Supervisord versions.