Devise registerable module may allow attackers to register themselves as staff/admins

[eliotsykes]

Devise's :registerable module allows users to register themselves.

If the :registerable module is incorrectly setup for staff/admin scope, then you may be allowing attackers to register themselves as staff/admin users.

The attackers may be able to HTTP POST to the Devise::RegistrationsController#create controller action and create users this way.

Where to start looking?

• Search for registerable usage in app/models and sub directories
• Search for registrations#create in the output from bin/rails routes

There is a valid use for :registerable, but only for user scopes that should be able to register themselves. On a public facing web site, this would be typically used for visitors who want to sign up for their own account.