Tell HN: Dropshare.app also runs a web server in localhost:34344

A fairly simple menu bar application available for macOS called DropShare.app [1] allows you to upload files to a remote server (3rd-party like Dropbox, Google Drive, or personal like your own AWS EC2 instance via SSH) and also manage these files once the upload is complete (delete, share, etc). After the security vulnerability discovered in Zoom [2] I decided to inspect all the apps that I have currently installed, and found that DropShare is also running an unprotected web server that any other app can access, and with more potential to make damage as it gives you full access to upload and delete files to/from the server.

  $ strings "/Applications/Dropshare 5.app/Contents/PlugIns/Share.appex/Contents/MacOS/Share" | grep 34344
  http://localhost:34344/status
  http://localhost:34344/connections
  http://localhost:34344/upload

  $ curl -i -XPOST "http://localhost:34344/upload"
  > HTTP/1.1 200 OK
  > Cache-Control: no-cache
  > Content-Length: 17
  > Content-Type: application/json
  > Connection: Close
  > Server: Dropshare4-Interface
  > Date: Wed, 10 Jul 2019 06:15:57 GMT
  > 
  > {"success":false}

  $ curl -i -X GET "http://localhost:34344/connections"
  > HTTP/1.1 200 OK
  > Cache-Control: no-cache
  > Content-Length: 17
  > Content-Type: application/json
  > Connection: Close
  > Server: Dropshare4-Interface
  > Date: Wed, 10 Jul 2019 06:16:14 GMT
  > 
  > {"success":false}

  $ curl -i -X GET "http://localhost:34344/status"
  > HTTP/1.1 200 OK
  > Cache-Control: no-cache
  > Content-Length: 38
  > Content-Type: application/json
  > Connection: Close
  > Server: Dropshare4-Interface
  > Date: Wed, 10 Jul 2019 06:16:22 GMT
  > 
  > {"version":"5.1.8 (5094)","ask":false}

[1] https://dropshare.app/

[2] https://news.ycombinator.com/item?id=20387298