CVE-2002-2435 in Internet Explorer
Summary
by MITRE
The Cascading Style Sheets (CSS) implementation in Microsoft Internet Explorer 8.0 and earlier does not properly handle the :visited pseudo-class, which allows remote attackers to obtain sensitive information about visited web pages via a crafted HTML document, a related issue to CVE-2010-2264.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/27/2021
The vulnerability described in CVE-2002-2435 represents a critical security flaw in Microsoft Internet Explorer's handling of CSS pseudo-classes, specifically the :visited selector. This issue affects Internet Explorer versions 8.0 and earlier, where the browser's CSS implementation fails to properly sanitize or restrict access to visited web page information through crafted HTML documents. The vulnerability stems from the browser's inability to adequately separate the presentation layer from the security model, creating an information disclosure channel that can be exploited by malicious actors.
The technical flaw manifests in how Internet Explorer processes the :visited pseudo-class within CSS rules. When a web page contains CSS rules that reference visited links, the browser should not allow external content to determine which links have been visited by inspecting the visual properties of those links. However, in affected versions, attackers can craft HTML documents that exploit this weakness to infer the visited status of links, potentially revealing sensitive user browsing history or personal information. This behavior violates fundamental security principles and creates a cross-site scripting vulnerability that can be leveraged to gather private data.
The operational impact of this vulnerability extends beyond simple information disclosure, as it enables sophisticated reconnaissance attacks where threat actors can map user browsing patterns and potentially identify sensitive online activities. Attackers can construct malicious web pages that, when viewed by victims, reveal which websites have been visited, including potentially sensitive domains such as medical sites, financial institutions, or personal communication platforms. This information can then be used for targeted attacks, social engineering, or to build profiles of user behavior and preferences, making the vulnerability particularly dangerous in environments where privacy and confidentiality are paramount.
The vulnerability aligns with CWE-200 (Information Exposure) and represents a classic example of how browser security models can be undermined through improper handling of CSS features. It also relates to ATT&CK technique T1566 (Phishing) and T1589 (Compromise Client Software Binary) as attackers can use this weakness to gather intelligence before launching more sophisticated attacks. Organizations should implement immediate mitigations including browser updates to newer versions, deployment of security patches, and user education about avoiding untrusted web content. Additionally, network-level protections such as content filtering and web application firewalls can help detect and block attempts to exploit this vulnerability, while security monitoring should include detection of suspicious CSS patterns that might indicate exploitation attempts.