What is Unimplemented or Unsupported Feature (CWE-447)?

TL;DR: Unimplemented or Unsupported Feature in UI (CWE-447) is a type of vulnerability where security features appear supported but are not implemented, leading to potential system vulnerabilities.

What is Unimplemented or Unsupported Feature in UI?

Unimplemented or Unsupported Feature in UI (CWE-447) is a type of vulnerability that occurs when a security feature appears to be supported and gives feedback to the user suggesting its support, but the underlying functionality is not implemented. As defined by the MITRE Corporation under CWE-447, and classified by the OWASP Foundation under A03:2025 - Software Supply Chain Failures.

Quick Summary

Unimplemented or Unsupported Feature in UI can lead to security misconfigurations and a false sense of security among users. This vulnerability can expose sensitive data and violate compliance regulations. Jump to: Overview · How It Works · Business Impact · Attack Scenario · Detection · Fixes

Jump to: Quick Summary · Unimplemented or Unsupported Feature in UI Overview · How Unimplemented or Unsupported Feature in UI Works · Business Impact of Unimplemented or Unsupported Feature in UI · Unimplemented or Unsupported Feature in UI Attack Scenario · How to Detect Unimplemented or Unsupported Feature in UI · How to Fix Unimplemented or Unsupported Feature in UI · Framework-Specific Fixes for Unimplemented or Unsupported Feature in UI · How to Ask AI to Check Your Code for Unimplemented or Unsupported Feature in UI · Unimplemented or Unsupported Feature in UI Best Practices Checklist · Unimplemented or Unsupported Feature in UI FAQ · Vulnerabilities Related to Unimplemented or Unsupported Feature in UI · References · Scan Your Own Site

Unimplemented or Unsupported Feature in UI Overview

What

Unimplemented or Unsupported Feature in UI is a type of vulnerability where security features appear supported but are not implemented.

Why it matters

This can lead to false sense of security among users and expose the system to vulnerabilities.

Where it occurs

In web applications, particularly those that advertise security features without proper implementation.

Who is affected

Users who rely on these advertised security features for their accounts’ safety.

Who is NOT affected

Applications that do not claim support for any security features or have properly implemented all advertised functionalities before deployment.

How Unimplemented or Unsupported Feature in UI Works

Root Cause

The root cause of this issue lies in the discrepancy between what a user interface suggests and what the underlying system actually supports. This can lead to users taking actions based on false information, potentially exposing them to security risks.

Attack Flow

1. User navigates to an application feature that claims to support a specific security measure.
2. The UI provides feedback indicating that the feature is enabled or available for use.
3. Upon further investigation, it turns out that the underlying functionality is not implemented, leading to potential vulnerabilities.

Prerequisites to Exploit

• A user interface that indicates support for a particular security feature.
• Lack of proper implementation for that feature in the backend system.

Vulnerable Code

def enable_two_factor_authentication(user_id):
    # Placeholder function without actual functionality
    print("Two-Factor Authentication Enabled")

This code snippet demonstrates a placeholder function that gives users the impression that two-factor authentication is enabled, but does not actually implement the feature.

Secure Code

def enable_two_factor_authentication(user_id):
    if user_has_valid_2fa_setup(user_id):
        print("Two-Factor Authentication Enabled")
    else:
        raise ValueError("Two-Factor Authentication Not Implemented")

The secure version checks whether two-factor authentication has been properly set up before enabling it, ensuring that users are not misled about the security status of their accounts.

Business Impact of Unimplemented or Unsupported Feature in UI

Confidentiality

Users may be unaware that sensitive data is exposed due to unsupported features.

Integrity

False feedback can lead to unauthorized modifications if users rely on non-existent security measures.

Availability

Misleading information can disrupt normal operations by leading users to take incorrect actions based on false assumptions.

Unimplemented or Unsupported Feature in UI Attack Scenario

1. User navigates to an application’s settings page.
2. The UI indicates that two-factor authentication is available for enabling.
3. Upon attempting to enable 2FA, the system does not actually implement this feature.
4. Users proceed with their activities under a false sense of security.

How to Detect Unimplemented or Unsupported Feature in UI

Manual Testing

• Navigate through all user interface features that claim support for security measures.
• Attempt to use these features and verify if they function as expected.
• Check the system logs for any discrepancies between advertised functionalities and actual behavior.

Automated Scanners (SAST / DAST)

Static analysis can detect placeholder functions or UI elements without corresponding backend functionality. Dynamic testing is required to confirm that the feature actually works when invoked.

PenScan Detection

PenScan’s automated scanners, such as ZAP and Wapiti, can identify discrepancies between advertised features and actual system behavior.

False Positive Guidance

A real vulnerability occurs only if a security feature appears supported but lacks proper implementation. If the UI feedback is accurate and reflects the true state of the system, it is not a false positive.

How to Fix Unimplemented or Unsupported Feature in UI

• Perform functionality testing before deploying the application.
• Ensure that all advertised functionalities are fully implemented and tested.

Framework-Specific Fixes for Unimplemented or Unsupported Feature in UI

def enable_two_factor_authentication(user_id):
    if user_has_valid_2fa_setup(user_id):
        print("Two-Factor Authentication Enabled")
    else:
        raise ValueError("Two-Factor Authentication Not Implemented")

This Python example demonstrates a secure implementation of enabling two-factor authentication by verifying the setup before proceeding.

How to Ask AI to Check Your Code for Unimplemented or Unsupported Feature in UI

Unimplemented or Unsupported Feature in UI Best Practices Checklist

• ✅ Perform functionality testing before deploying the application.
• ✅ Ensure that all advertised functionalities are fully implemented and tested.

Unimplemented or Unsupported Feature in UI FAQ

How does Unimplemented or Unsupported Feature in UI work?

It occurs when a security feature appears to be supported but is not actually implemented, misleading users and potentially exposing the system to vulnerabilities.

Can you show me an example of vulnerable code for this issue?

A web application might display options for enabling two-factor authentication (2FA) without having the actual functionality in place, leading users to believe their accounts are more secure than they really are.

What is the impact of Unimplemented or Unsupported Feature in UI on a business?

It can lead to security misconfigurations and false sense of security among users, potentially exposing sensitive data and violating compliance regulations.

How do I detect Unimplemented or Unsupported Feature in UI manually?

Manually test by attempting to use the feature and checking if it functions as expected. Look for discrepancies between UI feedback and actual system behavior.

What are some best practices to prevent this vulnerability?

document proper implementation of security features before deploying them, ensuring that all advertised functionalities work correctly.

How can developers fix Unimplemented or Unsupported Feature in UI issues?

Developers should ensure that any security feature displayed in the user interface is fully implemented and tested before deployment.

What are some common mistakes to avoid when dealing with this vulnerability?

Avoid implementing placeholder functionality without proper testing, as it can mislead users about the actual security state of their accounts.

Vulnerabilities Related to Unimplemented or Unsupported Feature in UI

References

• MITRE - CWE-447
• OWASP Top 10:2025 A03 - Software Supply Chain Failures
• NVD NIST CVE Database

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Unimplemented or Unsupported Feature in UI and other risks before an attacker does.