CVE-2025-31959 HCL BigFix SM EXIF信息泄露

import PIL.Image from PIL.ExifTags import TAGS, GPSTAGS def get_exif_data(image_path): """ Proof of Concept to extract EXIF data from an image. This simulates an attacker analyzing a downloaded image. """ try: image = PIL.Image.open(image_path) # Verify if image has EXIF data exif_data = image._getexif() if exif_data is None: print("No EXIF metadata found.") return print(f"[+] Analyzing {image_path}...") for tag, value in exif_data.items(): tag_name = TAGS.get(tag, tag) # Extract GPS Info specifically if tag_name == "GPSInfo": print(f" [!] Found GPS Info:") for gps_tag in value: gps_tag_name = GPSTAGS.get(gps_tag, gps_tag) print(f" {gps_tag_name}: {value[gps_tag]}") else: # Print other common tags (filtering binary data for display) if isinstance(value, (str, int, float, tuple)): print(f" {tag_name}: {value}") except Exception as e: print(f"Error: {e}") # Example usage: # get_exif_data("vulnerable_image.jpg")