Obsolete Feature in UI

Description

Obsolete Feature in UI is a vulnerability where a UI function is obsolete and the product does not warn the user. When software continues to display and allow interaction with deprecated or obsolete features without clearly communicating their status to users, it can lead to security issues. Users may rely on security features that are no longer functional, maintained, or effective due to changes in the underlying system, protocols, or threat landscape.

Risk

Obsolete features in UI pose significant security risks when users unknowingly rely on deprecated functionality for protection. Legacy encryption algorithms displayed as options may be broken but still selectable. Deprecated authentication methods may have known vulnerabilities but remain available. Security features that depended on external services that no longer exist continue to appear functional. Users configuring systems based on outdated documentation or training may enable obsolete features believing them to be secure. The lack of warnings allows insecure configurations to persist across system updates and migrations.

Solution

Remove outdated functionality from the user interface when it is no longer secure or supported. If removal is not immediately possible, clearly warn users that the feature is deprecated or obsolete and explain the security implications. Provide migration paths to replacement features with clear documentation. Implement deprecation warnings that are prominent and cannot be easily dismissed. Consider making obsolete security features opt-in rather than opt-out, requiring explicit acknowledgment of risks. Log usage of deprecated features for audit purposes.

Common Consequences

Impact	Details
Other	Scope: Other Quality Degradation - Software quality degrades when obsolete features remain accessible, leading to maintenance burden and user confusion.
Other	Scope: Other Varies by Context - Security impact depends on the specific obsolete feature. Deprecated encryption may expose data; obsolete authentication may allow unauthorized access.

Example Code

Vulnerable Code

// Vulnerable: Obsolete encryption options without warnings
class VulnerableEncryptionSettings {

    getAvailableAlgorithms() {
        // Vulnerable: Returns all algorithms including broken ones
        return [
            { id: 'des', name: 'DES', description: 'Data Encryption Standard' },
            { id: 'rc4', name: 'RC4', description: 'Rivest Cipher 4' },
            { id: '3des', name: '3DES', description: 'Triple DES' },
            { id: 'aes128', name: 'AES-128', description: 'Advanced Encryption Standard 128-bit' },
            { id: 'aes256', name: 'AES-256', description: 'Advanced Encryption Standard 256-bit' }
        ];
        // No indication that DES and RC4 are broken
        // No warning that 3DES is deprecated
    }

    // Vulnerable: Accepts obsolete algorithm without warning
    setEncryption(algorithm) {
        // User selects 'DES' - no warning that it's broken
        this.currentAlgorithm = algorithm;
        this.encrypt_with(algorithm);
        return { success: true, message: `Encryption set to ${algorithm}` };
    }
}

# Vulnerable: Deprecated authentication methods still available
class VulnerableAuthConfig:
    def __init__(self):
        self.available_methods = [
            'md5_passwords',      # Broken hash
            'sha1_passwords',     # Weak hash
            'cleartext_ldap',     # No encryption
            'sslv3',              # Broken protocol
            'tlsv1',              # Deprecated
            'tlsv1.2',            # Current
            'tlsv1.3'             # Current
        ]

    def get_auth_methods(self):
        # Vulnerable: Returns all methods without deprecation info
        return self.available_methods

    def set_auth_method(self, method):
        # Vulnerable: No warning for deprecated methods
        if method in self.available_methods:
            self.current_method = method
            return True
        return False

    # User sets 'sslv3' - no warning about POODLE vulnerability
    # User sets 'md5_passwords' - no warning about collision attacks

// Vulnerable: Legacy API endpoints without deprecation warnings
public class VulnerableAPIConfiguration {

    // Vulnerable: Legacy authentication still available
    public List<String> getAuthenticationEndpoints() {
        return Arrays.asList(
            "/api/v1/auth/basic",    // Basic auth over HTTP (insecure)
            "/api/v1/auth/digest",   // Digest auth (outdated)
            "/api/v2/auth/oauth1",   // OAuth 1.0 (deprecated)
            "/api/v2/auth/oauth2",   // Current
            "/api/v3/auth/oidc"      // Current
        );
        // No indication which endpoints are obsolete
    }

    // Vulnerable: Old certificate validation methods
    public void setCertificateValidation(String mode) {
        // Available modes shown in UI:
        // - "none" (no validation - dangerous)
        // - "basic" (hostname check only - weak)
        // - "standard" (CA chain validation)
        // - "strict" (certificate pinning)

        // Vulnerable: "none" and "basic" accepted without warning
        this.validationMode = mode;
        configureTrustManager(mode);
    }
}

<!-- Vulnerable: Configuration file with obsolete options -->
<security-config>
    <!-- Vulnerable: Obsolete cipher suites listed without deprecation -->
    <cipher-suites>
        <suite>SSL_RSA_WITH_RC4_128_MD5</suite>
        <suite>SSL_RSA_WITH_3DES_EDE_CBC_SHA</suite>
        <suite>TLS_RSA_WITH_AES_128_CBC_SHA</suite>
        <suite>TLS_RSA_WITH_AES_256_GCM_SHA384</suite>
    </cipher-suites>

    <!-- Vulnerable: Deprecated protocols enabled by default -->
    <protocols>
        <protocol>SSLv3</protocol>
        <protocol>TLSv1</protocol>
        <protocol>TLSv1.1</protocol>
        <protocol>TLSv1.2</protocol>
    </protocols>

    <!-- No warnings or documentation about which options are obsolete -->
</security-config>

Fixed Code

// Fixed: Encryption settings with clear deprecation information
class SecureEncryptionSettings {

    getAvailableAlgorithms() {
        return [
            {
                id: 'des',
                name: 'DES',
                description: 'Data Encryption Standard',
                status: 'BROKEN',
                warning: 'DES is cryptographically broken. Do not use.',
                recommendedAlternative: 'aes256'
            },
            {
                id: 'rc4',
                name: 'RC4',
                description: 'Rivest Cipher 4',
                status: 'BROKEN',
                warning: 'RC4 has multiple known vulnerabilities. Do not use.',
                recommendedAlternative: 'aes256'
            },
            {
                id: '3des',
                name: '3DES',
                description: 'Triple DES',
                status: 'DEPRECATED',
                warning: '3DES is deprecated due to small block size. Migrate to AES.',
                deprecationDate: '2023-12-31',
                recommendedAlternative: 'aes256'
            },
            {
                id: 'aes128',
                name: 'AES-128',
                description: 'Advanced Encryption Standard 128-bit',
                status: 'CURRENT',
                warning: null,
                recommendedAlternative: null
            },
            {
                id: 'aes256',
                name: 'AES-256',
                description: 'Advanced Encryption Standard 256-bit',
                status: 'RECOMMENDED',
                warning: null,
                recommendedAlternative: null
            }
        ];
    }

    setEncryption(algorithm) {
        const algoInfo = this.getAvailableAlgorithms().find(a => a.id === algorithm);

        // Fixed: Block broken algorithms
        if (algoInfo.status === 'BROKEN') {
            return {
                success: false,
                message: algoInfo.warning,
                recommendedAlternative: algoInfo.recommendedAlternative
            };
        }

        // Fixed: Warn about deprecated algorithms
        if (algoInfo.status === 'DEPRECATED') {
            // Require explicit acknowledgment
            return {
                success: false,
                requiresAcknowledgment: true,
                message: algoInfo.warning,
                deprecationDate: algoInfo.deprecationDate,
                recommendedAlternative: algoInfo.recommendedAlternative
            };
        }

        this.currentAlgorithm = algorithm;
        return { success: true, message: `Encryption set to ${algorithm}` };
    }

    setEncryptionWithAcknowledgment(algorithm, acknowledgedRisks) {
        if (!acknowledgedRisks) {
            return {
                success: false,
                message: 'Must acknowledge deprecation risks'
            };
        }

        // Fixed: Log usage of deprecated algorithm
        console.warn(`Deprecated algorithm ${algorithm} enabled with acknowledgment`);
        auditLog.record('DEPRECATED_ALGORITHM_ENABLED', { algorithm, timestamp: Date.now() });

        this.currentAlgorithm = algorithm;
        return {
            success: true,
            message: `${algorithm} enabled (deprecated)`,
            warning: 'This algorithm will be removed in a future version'
        };
    }
}

# Fixed: Authentication methods with deprecation warnings
class SecureAuthConfig:
    AUTH_METHODS = {
        'md5_passwords': {
            'status': 'REMOVED',
            'message': 'MD5 password hashing has been removed due to collision vulnerabilities.',
            'alternative': 'argon2'
        },
        'sha1_passwords': {
            'status': 'DEPRECATED',
            'message': 'SHA1 is deprecated. Migrate to Argon2 or bcrypt.',
            'removal_date': '2024-06-01',
            'alternative': 'argon2'
        },
        'cleartext_ldap': {
            'status': 'DEPRECATED',
            'message': 'Cleartext LDAP exposes credentials. Use LDAPS.',
            'alternative': 'ldaps'
        },
        'sslv3': {
            'status': 'REMOVED',
            'message': 'SSLv3 removed due to POODLE vulnerability.',
            'alternative': 'tlsv1.3'
        },
        'tlsv1': {
            'status': 'DEPRECATED',
            'message': 'TLS 1.0 is deprecated by PCI-DSS. Use TLS 1.2+.',
            'removal_date': '2024-01-01',
            'alternative': 'tlsv1.3'
        },
        'tlsv1.2': {
            'status': 'SUPPORTED',
            'message': None,
            'alternative': None
        },
        'tlsv1.3': {
            'status': 'RECOMMENDED',
            'message': None,
            'alternative': None
        },
        'argon2': {
            'status': 'RECOMMENDED',
            'message': None,
            'alternative': None
        }
    }

    def get_auth_methods(self):
        # Fixed: Return methods with status information
        return {
            method: info for method, info in self.AUTH_METHODS.items()
            if info['status'] != 'REMOVED'
        }

    def set_auth_method(self, method, acknowledge_deprecation=False):
        if method not in self.AUTH_METHODS:
            return {'success': False, 'message': 'Unknown method'}

        info = self.AUTH_METHODS[method]

        # Fixed: Block removed methods
        if info['status'] == 'REMOVED':
            return {
                'success': False,
                'message': info['message'],
                'alternative': info['alternative']
            }

        # Fixed: Require acknowledgment for deprecated methods
        if info['status'] == 'DEPRECATED':
            if not acknowledge_deprecation:
                return {
                    'success': False,
                    'requires_acknowledgment': True,
                    'message': info['message'],
                    'removal_date': info.get('removal_date'),
                    'alternative': info['alternative']
                }
            # Log deprecated usage
            logger.warning(f"Deprecated auth method enabled: {method}")

        self.current_method = method
        return {'success': True, 'method': method, 'status': info['status']}

// Fixed: API configuration with deprecation handling
public class SecureAPIConfiguration {

    private static final Map<String, EndpointInfo> ENDPOINTS = Map.of(
        "/api/v1/auth/basic", new EndpointInfo(
            Status.REMOVED,
            "Basic auth removed - credentials exposed over HTTP",
            "/api/v3/auth/oidc"
        ),
        "/api/v1/auth/digest", new EndpointInfo(
            Status.DEPRECATED,
            "Digest auth deprecated - weak security",
            "/api/v3/auth/oidc",
            LocalDate.of(2024, 6, 1)
        ),
        "/api/v2/auth/oauth1", new EndpointInfo(
            Status.DEPRECATED,
            "OAuth 1.0 deprecated - migrate to OAuth 2.0 or OIDC",
            "/api/v3/auth/oidc",
            LocalDate.of(2024, 3, 1)
        ),
        "/api/v2/auth/oauth2", new EndpointInfo(Status.SUPPORTED),
        "/api/v3/auth/oidc", new EndpointInfo(Status.RECOMMENDED)
    );

    public List<EndpointInfo> getAuthenticationEndpoints() {
        // Fixed: Return full information including status
        return ENDPOINTS.entrySet().stream()
            .filter(e -> e.getValue().getStatus() != Status.REMOVED)
            .map(e -> new EndpointInfo(e.getKey(), e.getValue()))
            .collect(Collectors.toList());
    }

    public ConfigResult setCertificateValidation(String mode) {
        ValidationModeInfo info = getValidationModeInfo(mode);

        // Fixed: Block insecure modes
        if (info.status == Status.BLOCKED) {
            return new ConfigResult(
                false,
                info.message,
                info.alternative
            );
        }

        // Fixed: Warn about weak modes
        if (info.status == Status.DEPRECATED) {
            logger.warn("Weak certificate validation mode selected: " + mode);
            return new ConfigResult(
                false,
                info.message,
                true,  // requiresAcknowledgment
                info.alternative
            );
        }

        configureTrustManager(mode);
        return new ConfigResult(true, "Certificate validation configured");
    }

    private ValidationModeInfo getValidationModeInfo(String mode) {
        switch (mode) {
            case "none":
                return new ValidationModeInfo(
                    Status.BLOCKED,
                    "Disabling certificate validation is not allowed",
                    "strict"
                );
            case "basic":
                return new ValidationModeInfo(
                    Status.DEPRECATED,
                    "Basic validation is insecure - use standard or strict",
                    "standard"
                );
            case "standard":
                return new ValidationModeInfo(Status.SUPPORTED);
            case "strict":
                return new ValidationModeInfo(Status.RECOMMENDED);
            default:
                return new ValidationModeInfo(Status.UNKNOWN);
        }
    }
}

---

CVE Examples

No specific CVEs are listed in the MITRE database for this CWE. However, the pattern is common in:

• Legacy cipher suite availability in TLS configurations
• Deprecated hash function options in authentication systems
• Obsolete API versions that remain accessible

---

References

1. MITRE Corporation. "CWE-448: Obsolete Feature in UI." https://cwe.mitre.org/data/definitions/448.html
2. NIST. "Transitioning the Use of Cryptographic Algorithms and Key Lengths." SP 800-131A.