---
title: "NET-APP-002 Application Server Ports Reachable Without a Reverse Proxy"
canonical: https://openvapt.com/checks/NET-APP-002.html
html: https://openvapt.com/checks/NET-APP-002.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-16
version: 0.1.0-alpha.6
---

# NET-APP-002 Application Server Ports Reachable Without a Reverse Proxy

Checks whether application servers and developer tools (Node.js, Tomcat, Django, Flask, Vite) serve HTTP on network-reachable addresses.

- Domain: Network
- Severity: Medium
- Control category: Network Exposure
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L`
- CIS Controls v8: 4.8
- NIST CSF 2.0: PR.PS-01, PR.IR-01
- CWE: CWE-1188, CWE-1327
- OWASP Top 10 2021: A05:2021
- NIST SP 800-53 Rev. 5: SC-7, CM-7
- Benchmark topic: Expose applications only through a hardened front end (topic only, no benchmark text)

## Why It Matters

Application servers are designed to sit behind a reverse proxy that adds TLS, security headers, logging and request limits. Reached directly they bypass all of that, and development servers on these ports often run with debug pages on. The port number alone does not prove a weakness, so this is rated Medium and should be reviewed.

## How It Detects

Matches network-reachable listening TCP sockets from /proc/net against the default HTTP ports of common application servers and developer tools, recording how each is bound and whether a web server listens on port 80 or 443 on this machine (which suggests the application was meant to be proxied). No packets are sent.

## How to Fix

Bind the application to 127.0.0.1 (Node.js: app.listen(3000, '127.0.0.1'); Gunicorn: --bind 127.0.0.1:8000; Tomcat: address="127.0.0.1" on the Connector) and publish it only through nginx or Apache.

## How to Verify

```
ss -tlnp  shows these ports on 127.0.0.1 or ::1 only.
```

## Learn the Theory

- [P13 Application Servers: Tomcat, Node.js and Python](https://openvapt.com/academy/p13.md)

## References

- [OWASP Node.js Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html)
- [Gunicorn documentation, Deploying Gunicorn (behind a proxy)](https://gunicorn.org/deploy/)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/firewall_exposure.go

Run it: `openvapt scan --only NET-APP-002`. Read it offline: `openvapt explain NET-APP-002`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/NET-APP-002.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.