Skip to main content
protocols.pageprotocols.page
9443

Port 9443 – WebSphere HTTPS / WSO2

TCP

Port 9443 is the IBM WebSphere application HTTPS port and WSO2 Carbon management console port. WebSphere serves deployed apps over TLS on 9443. WSO2 products (API Manager, Identity Server) serve their admin console on 9443. Both are management-sensitive – restrict access appropriately for each service.

Port Number

9443

Protocol

TCP

Service

WebSphere App HTTPS / WSO2 Management

Range

IANA Registered (1024–49151)

Description

Port 9443 serves as the TLS-encrypted application port for WebSphere (the HTTPS equivalent of port 9080) and simultaneously as the management console port for WSO2 Carbon-based products. In a WebSphere environment, end-user HTTPS requests reach applications on port 9443. For WSO2, port 9443 is the admin console – it provides full control over API definitions, identity federation, service bus configurations, and user management. Treat it as equivalent to root access for the integration platform. In production WSO2 deployments, restrict port 9443 to administrators and separate it from the API gateway traffic ports (8243/8280).

Security risks

  • 1CVE-2022-29464 (CVSS 9.8): WSO2 arbitrary file upload RCE – unauthenticated attacker uploads a malicious JSP file via the /fileupload endpoint on port 9443, achieving immediate remote code execution. Actively exploited in the wild within days of disclosure. Affected: WSO2 API Manager, Identity Server, Enterprise Integrator.
  • 2CVE-2021-42340 (Apache Tomcat/WSO2): DoS via incomplete POST request handling on the HTTPS connector – attacker exhausts thread pool causing service unavailability.
  • 3WSO2 admin console (https://host:9443/carbon/) provides full platform control: API creation, OAuth token management, identity federation, and service bus configuration. Compromised access = control of all integrated systems.
  • 4WebSphere application TLS misconfiguration: default self-signed certificates, support for deprecated TLS versions (1.0/1.1), and weak cipher suites are common on port 9443 in older WebSphere installations.
  • 5Dual-use port ambiguity: port 9443 serving both WebSphere application traffic AND WSO2 admin in different environments means security teams may not apply appropriate admin-level restrictions, treating it as just another HTTPS port.

Firewall guidance

For WebSphere: port 9443 carries application traffic – front with IHS or load balancer on port 443. Direct internet exposure is acceptable only through a WAF. For WSO2: port 9443 is the ADMIN console – restrict to operator workstations only. WSO2 API gateway traffic should use separate ports (8243/8280) that are internet-facing. Never expose the WSO2 /carbon/ console to the internet.

Diagnosis commands

Identify whether port 9443 is WebSphere or WSO2 from response headers

shell
curl -kI https://host:9443/ 2>&1 | grep -i 'server\|wso2\|websphere'

Test if WSO2 Carbon admin console is accessible (200 = exposed, should be restricted)

shell
curl -k https://host:9443/carbon/ -o /dev/null -w '%{http_code}'

Inspect TLS certificate to identify the service and check for self-signed certs

shell
openssl s_client -connect host:9443 </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer

Detect service, audit TLS configuration, and identify the application

shell
nmap -sV -p 9443 --script ssl-enum-ciphers,http-title target

Usage examples

Port 9443 – WebSphere HTTPS / WSO2
shell
curl -k https://washost:9443/myapp/
WSO2: https://host:9443/carbon/ (admin login)
openssl s_client -connect host:9443 -servername host

Common services on this port

IBM WebSphere Application ServerWSO2 API ManagerWSO2 Identity ServerWSO2 Enterprise IntegratorWSO2 Micro Integrator

Related ports

9080

WebSphere Application HTTP

9043

WebSphere Admin HTTPS

8243

WSO2 HTTPS gateway (API traffic)

8280

WSO2 HTTP gateway (API traffic)

History

Port 9443 was established as the WebSphere application HTTPS port in WebSphere 5.x (2003), paired with port 9080 for HTTP. WSO2 adopted port 9443 for its Carbon admin console starting with WSO2 Carbon 4.x (2012). The dual usage means port 9443 context depends entirely on which product is deployed. CVE-2022-29464 against WSO2 was one of the most impactful vulnerabilities of 2022, with CISA adding it to the Known Exploited Vulnerabilities catalog within a week of disclosure.

FAQ

How do I check if my WSO2 is vulnerable to CVE-2022-29464?

Affected versions: WSO2 API Manager 2.2.0-4.0.0, Identity Server 5.2.0-5.11.0, Enterprise Integrator 6.2.0-6.6.0. Check: curl -k 'https://host:9443/fileupload/toolsAny' – if it returns 200 or a file upload form, you are vulnerable. Fix: update to the latest version, or apply the provided patch (WSO2-2021-1738). Immediate mitigation: block /fileupload/* in your reverse proxy.

Should WSO2 API gateway and admin console share port 9443?

No. Best practice: WSO2 admin console on port 9443 restricted to internal admin network. API gateway on ports 8243 (HTTPS) and 8280 (HTTP) exposed to API consumers through a load balancer. This separation means CVE-2022-29464 style admin-surface attacks cannot reach the internet-facing API gateway ports, and API traffic DDoS does not affect admin access.