Security Assessment: Network Port Findings

Overview

This document responds to three security observations raised during a customer network/security scan of machines running the CapaOne Agent. Each finding is assessed against the actual product behaviour (code), with the relevant controls and any planned hardening described.

#	Finding	Assessment	Status
1	Port 9999 — unencrypted HTTP exposing data	Valid in part — local-subnet only; diagnostic endpoints being removed	Hardening planned
2	JWT tokens visible on port 9999	Not confirmed — backend authentication is TLS-only; observed data is non-secret	Clarification + hardening
3	Port 8181 — “Microsoft .NET Remoting Services”	Not the current agent — legacy CiStub product	Customer decommission

Finding 1 — Port 9999 (HTTP, unencrypted)

What it is

Port 9999 is a local web endpoint used by the agent for peer-to-peer file sharing (“peering”). This is a bandwidth-saving feature: instead of every client downloading large packages (e.g. Office, Visual Studio Code) directly from the CDN, an agent can fetch an already-cached copy from a nearby agent on the same network.

The port is auto-selected starting at 9999.
The agent’s own inbound firewall rule is scoped to the local subnet — it is not opened to the internet.

What is reachable

/file/{id} — the peering file endpoint that serves cached installation files to nearby agents in the same organization.
A set of human-readable diagnostic endpoints (/info, /config, /setting, /peering) intended for troubleshooting. These return non-secret operational data such as agent version, computer name and configuration state.

Controls protecting the peering channel

Organization gating — only agents sharing the same organization key participate.
Knowledge-gated requests — to request a file, an agent must already know the file’s exact MD5 checksum, which is delivered over the encrypted backend channel.
Single-use tokens (nonces) — a peer response contains a one-time token, not the filename or checksum; the download URL therefore reveals nothing about the content.
Integrity verification — downloaded files are verified before use and must be valid, installable archives. A file that does not match expectations is rejected.
Public content only — the files shared between peers are public vendor installers. No confidential or customer data traverses this channel.

Why HTTP rather than HTTPS

The peering endpoint deliberately avoids TLS to remove the need to provision and manage certificates on every managed client. This is an accepted trade-off because the channel’s security relies on integrity (the verification above), not on confidentiality — the content being shared is already publicly available.

Planned hardening

The diagnostic endpoints (/info, /config, /setting, /peering, and the header-diagnostic helpers) are being removed from the network surface. They are convenience features for debugging and are not required for normal operation.
After this change, the only network-facing endpoint is the nonce-protected /file/{id} peering download.

Finding 2 — JWT tokens on port 9999

Clarification

The agent authenticates to the CapaOne backend over TLS-encrypted gRPC (HTTPS, port 443, outbound). Authentication material is never transmitted over port 9999.
The agent does not host or serve a JWT on the local port.
What was observed on port 9999 was most likely one of:
- non-secret identity/configuration values (e.g. organization key, device id) rendered by the diagnostic web view, or
- an authorization header reflected back to the caller that sent it by a diagnostic helper endpoint (i.e. the scanner observing its own request header).

Status

Removing the diagnostic endpoints (Finding 1) eliminates this exposure entirely.
Package-download tokens used during installation are transmitted only inside the TLS-encrypted backend channel, and are automatically masked in agent log files.

Finding 3 — Port 8181 (“Microsoft .NET Remoting Services”)

Assessment

The current CapaOne Agent (.NET 10) does not open or listen on port 8181 and does not use .NET Remoting. This has been verified against the product source.
Port 8181 (together with 8080/8282) and the use of .NET Remoting are characteristics of our legacy CiStub agent, a .NET Framework predecessor of the current product. The scanner’s “Microsoft .NET Remoting Services” label is, in this case, a correct identification of that older component — not the modern agent.
This strongly indicates a leftover or partially decommissioned CiStub installation on the host, operating independently of the current agent.

Recommended remediation

Identify the process listening on 8181 and locate any remaining CiStub installation:

PowerShell

# Identify what is actually listening on 8181
Get-NetTCPConnection -LocalPort 8181 -State Listen |
  Select-Object LocalAddress, OwningProcess,
  @{N='Process';E={ (Get-Process -Id $_.OwningProcess).Path }}

# Look for the legacy CiStub service and binaries
Get-Service | Where-Object { $_.Name -like '*CiStub*' -or $_.DisplayName -like '*CiStub*' }
Get-ChildItem -Path 'C:\Program Files*','C:\ProgramData' -Recurse -Filter '*cistub*' -ErrorAction SilentlyContinue

Once the legacy CiStub installation is uninstalled/decommissioned, port 8181 will close.

Hardening recommendations for your environment

Peering scope — peering is restricted to the local subnet by design. If cross-client file sharing is not desired in a given environment, it can be disabled, which removes the need for the local listener.
Decommission legacy software — remove the leftover CiStub installation (Finding 3) to close port 8181.
Host firewall — customers retain full control of inbound rules and may further restrict the peering port (e.g. to specific peer hosts) according to local policy.

Summary

Port 9999 is a local-subnet, integrity-protected peering channel; the unauthenticated diagnostic endpoints are being removed as a hardening measure.
JWT exposure is not present on port 9999; backend authentication is TLS-only, and download tokens are masked in logs.
Port 8181 belongs to the legacy CiStub product and should be decommissioned on the host; it is not part of the current CapaOne Agent.