CyberHunter
LinkedIn profile - Bastien Cordier Email: contact@bastiencordier.pro
// DevOps, cloud & containers

Port 2375: Docker API (HTTP)

Docker Engine API without TLS. Exposing it gives root on the host to anyone.

Docker daemondockerd
2375

How Docker API (HTTP) works

DevOps, cloud & containers
adminhostdocker run adminhostdocker run

Commands sent to port 2375 create and control containers or cluster resources on the host. It travels in clear text: anyone on the path can read it.

Transport
TCP
Exposure risk
10/10 critical if reachable from the Internet
Encryption
Clear textreadable on the network
IANA status
Assignedcommon use differs from the registry
Range
Registered (1024-49151)
Category
DevOps, cloud & containers
01 Security

Is port 2375 dangerous?

Common attacks and weaknesses

  • Anyone can start a privileged container and take over the host.
  • Massively exploited by cryptominer botnets.

How to secure it

  • Never enable the TCP socket without TLS; use the Unix socket or SSH.
  • If remote access is required, use 2376 with mutual TLS.

Unofficial use. The IANA assignment below differs from what is usually found on this port in practice.

02 Registry

IANA registry entries for port 2375

ServicePortTransportDescriptionReferenceUpdated
docker 2375 TCP Docker REST API (plain text) - 2014-04-17
-2375-Reserved--

// source: IANA service name and port number registry

03 Check it

Which program uses port 2375, and is it reachable?

Linux

sudo ss -ltnup 'sport = :2375'      # process listening on 2375
sudo lsof -nP -i :2375

macOS

sudo lsof -nP -i :2375

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 2375 -State Listen | Select LocalAddress, OwningProcess
Get-NetUDPEndpoint -LocalPort 2375
netstat -ano | findstr :2375

From another machine

nmap -p 2375 -sV <host>
nc -zv <host> 2375

Block it in the firewall

sudo ufw deny 2375/tcp                                         # Linux (ufw)
New-NetFirewallRule -DisplayName "Block 2375" -Direction Inbound -LocalPort 2375 -Protocol TCP -Action Block  # Windows
04 FAQ
What is port 2375 used for?

Docker Engine API without TLS. Exposing it gives root on the host to anyone.

Is port 2375 TCP or UDP?

Port 2375 is registered for TCP.

Is it safe to open port 2375?

It is rated 10/10 (critical) when exposed to the Internet. Anyone can start a privileged container and take over the host. Never enable the TCP socket without TLS; use the Unix socket or SSH.

How do I check if port 2375 is open?

On Linux run "ss -ltnup 'sport = :2375'", on macOS "lsof -nP -i :2375", and on Windows "netstat -ano | findstr :2375" to see the local process. From another machine, "nmap -p 2375 <host>" shows whether it is reachable.

05 Related
:2376 Docker API (TLS) tcp · high risk :6443 Kubernetes API tcp · udp · high risk :10250 Kubelet API tcp · critical risk :2379 etcd tcp · critical risk :8500 Consul tcp · udp · high risk :4505 SaltStack tcp · critical risk :9000 PHP-FPM / SonarQube / Portainer tcp · udp · high risk :677 Virtual Presence Protocol tcp · udp

Latest vulnerability news

All news