Description
The Boost module caches generated Drupal pages as static files so they can be served directly by the web server, bypassing PHP entirely. The `boost_is_cacheable()` function contains a guard that is supposed to prevent pages carrying a `?destination=` query parameter from being cached, since those pages are typically part of authentication redirect flows.
The module doesn't correctly reference the query data. PHP silently treats an undefined variable as `NULL`, so `!empty(NULL['destination'])` always evaluates to `FALSE`, meaning the destination guard never fires and every page with a `?destination=` parameter passes the cacheability check unchanged.
This vulnerability is mitigated by the fact that the cached page content itself does not change based on the destination parameter; the principal risk is that pages which Boost intentionally excludes from caching (to prevent stale authentication-redirect content from being served) are instead cached and delivered to subsequent visitors.
Solution
Install the latest version.
If you use the Boost module for Drupal 7, upgrade to boost 7.x-1.3:
Reported by
Fixed by
- Tag1 D7ES
Coordinated by
- Tag1 D7ES