3000
Summary
- // if you see it open
- Developers frequently leave dev servers or Grafana bound to 0.0.0.0:3000 without firewalling, exposing them to Shodan and internet scanners. Recurring findings: debug endpoints and unauthenticated Node.js APIs reachable publicly; Grafana panels with default admin credentials or anonymous access. CVEs in port-3000 software include CVE-2024-1863 (Sante PACS Server — SQL injection on the port-3000 token endpoint enabling unauthenticated RCE, 2024) and CVE-2017-5941 (node-serialize deserialization RCE in the Node.js ecosystem). Mitigations: reverse-proxy behind 80/443, firewall direct internet access to 3000, disable debug endpoints in production, enforce authentication on any service defaulting to this port.
- // analyst note
- A responsive port 3000 is far more likely a web dev server, Grafana, or Rocket.Chat than the registered HBCI service — check for exposed admin panels and unauthenticated APIs before assuming a banking protocol.
About port 3000/tcp.
Port 3000/tcp is registered with IANA as hbci with the description "HBCI," assignee and contact Kurt Haubner, and blank Registration Date, Modification Date, and Reference fields (dual-registered on TCP and UDP). HBCI — the Home Banking Computer Interface — is the German bank-independent online-banking protocol later folded into the FinTS standard; the registered port carried the non-HTTPS HBCI connection, while modern FinTS 3.0+ moved to HTTPS, so the formal registrant has little to do with what an analyst actually meets on this port. A second 3000/tcp row exists in the registry for remoteware-cl ("RemoteWare Client," assignee Tim Farley), explicitly annotated "This entry records an unassigned but widespread use" — IANA's own acknowledgment that port 3000 is heavily used informally and unassigned. That informal use dominates reality: port 3000 is the de-facto default development-server port for the JavaScript and Ruby web ecosystem — Node.js/Express, Create React App, Vue CLI, Angular CLI, Meteor, NestJS, and Sails.js all bind it by default — and the production default for Grafana monitoring dashboards and Rocket.Chat. For an analyst this matters because developers routinely leave these servers bound to 0.0.0.0:3000 without firewalling, making them discoverable by Shodan and internet-wide scanners; exposed Grafana panels (sometimes with default or anonymous access), debug endpoints, and unauthenticated Node.js APIs are the recurring findings. Port-3000 software has also carried real CVEs, including CVE-2024-1863 (Sante PACS Server SQL-injection RCE on the port-3000 token endpoint) and the node ecosystem's CVE-2017-5941 (node-serialize deserialization RCE). The IANA Reference field is blank — no RFC governs the port number itself.
- IANA assignment
hbci— "HBCI" (Home Banking Computer Interface); reference (blank — no RFC cited in IANA registry); assignee/contact Kurt Haubner; dual-registered 3000/tcp + 3000/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- registered (1024–49151)
- Related ports
- 8080/3001/5000/8000 (other common dev-server / alt-HTTP ports); 443 (where HBCI/FinTS now lives)
Primary use (real-world)
de-facto default development-server port for Node.js/Express, Create React App, Vue CLI, Angular CLI, Meteor, NestJS, Sails.js; production default for Grafana and Rocket.Chat
Common software
Node.js (Express), Rails, React/Vue/Angular dev servers, Meteor, NestJS, Sails.js, Grafana, Rocket.Chat, HedgeDoc, legacy HBCI/FinTS clients
Security implications
dev-to-prod exposure of debug endpoints/unauthenticated APIs; Grafana default/anonymous-access misconfig; CVE-2024-1863 (Sante PACS Server SQLi→RCE on port-3000 token endpoint, 2024); CVE-2017-5941 (node-serialize deserialization RCE)
Typically seen on
developer workstations and CI hosts running dev servers; Grafana/Rocket.Chat deployments; rarely an actual HBCI banking endpoint
- Second IANA entry
remoteware-cl— "RemoteWare Client"; assignee Tim Farley; Assignment Notes "This entry records an unassigned but widespread use" (documents informal prevalence, not a formal second assignment) [Confirmed] — IANA registry- Formal use
- HBCI/FinTS legacy German online-banking protocol (non-HTTPS HBCI connection; FinTS 3.0+ moved to HTTPS) [Likely] — Wikipedia FinTS
- Scanning exposure
- actively probed by Shodan and internet-wide scanners hunting unauthenticated admin panels, Grafana dashboards, and exposed Node APIs [Likely] — scanitex.com, pentestpad.com
- Analyst note
- A responsive port 3000 is far more likely a web dev server, Grafana, or Rocket.Chat than the registered HBCI service — check for exposed admin panels and unauthenticated APIs before assuming a banking protocol.
About port 3000/udp.
Port 3000/udp carries two IANA registrations, neither of which describes an actually-deployed UDP protocol. The first is hbci — "HBCI" (Home Banking Computer Interface), assignee Kurt Haubner, reference field blank. HBCI is a German bank-independent online-banking protocol introduced in 1995 by the Sparkassen-Finanzgruppe, the cooperative banking group, and the Association of German Banks; later versions were renamed FinTS in 2002 and moved to HTTPS on port 443. In practice HBCI/FinTS ran over TCP port 3000, so the UDP entry is a mirror registration carried alongside the TCP slot rather than a protocol that ever spoke UDP on the wire. The second registration is remoteware-cl — "RemoteWare Client," assignee Tim Farley, annotated in the registry as "This entry records an unassigned but widespread use," meaning no party formally applied for the slot. RemoteWare was a low-bandwidth remote data-distribution and management product from iAnywhere Solutions (formerly Sybase). Neither use is active today: modern port-3000 traffic is overwhelmingly development servers (Ruby on Rails, Node.js, Grafana) on TCP, and the Wikipedia port list leaves the 3000 UDP column blank with no documented unofficial UDP use. No RFC or formal IANA reference exists for either entry — the blank reference is the authoritative answer, not a gap. For an analyst, a responsive 3000/udp has no known legitimate service to explain it and warrants treating as an anomaly; AuditMyPC notes a historical (not active) trojan association and lists current virus/trojan risk as "No." There is no operational reason to expose 3000/udp at a perimeter, so blocking it by default is the safe posture.
- IANA assignment
hbci— "HBCI"; reference (blank — no RFC cited in IANA registry); assignee Kurt Haubner; dual-registered 3000/tcp + 3000/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry)- Range class
- registered (1024–49151)
- Prevalence
- no active UDP service known; modern port-3000 traffic is dev servers (Rails/Node.js/Grafana) on TCP, not UDP [Likely] — Wikipedia List of TCP and UDP port numbers (UDP 3000 column blank)
- Related ports
- 3000/tcp (same dual registration; dominant modern dev-server use); the FinTS/HTTPS migration to 443
Primary use
HBCI/FinTS German online-banking protocol — legacy deployments used TCP port 3000; the UDP registration is a carry-along mirror, not a functional UDP protocol
Other/unofficial uses
RemoteWare Client (iAnywhere Solutions / Sybase) remote data-distribution product; recorded as informal "widespread use," not a formal UDP assignment
Security implications
no known active legitimate service on 3000/udp; AuditMyPC flags a historical (not current) trojan association and lists active virus/trojan risk as "No"; broad scanning studies (Shodan/ZMap) do not call out 3000/udp as a notable exposure
Typically seen on
nothing in active use; a responsive 3000/udp is an anomaly worth investigating
- Second IANA assignment
remoteware-cl— "RemoteWare Client"; reference (blank); assignee Tim Farley; Assignment Notes "This entry records an unassigned but widespread use"; also dual-registered tcp+udp [Confirmed] — IANA registry CSV- Analyst note
- No live service is expected on 3000/udp. Treat a response as anomalous; there is no operational reason to expose it externally — block at perimeter by default.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| ppp | TCP | remoteware-cl | 0.41% |
| hbci | UDP | — | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.