/ 
Rex-1.16.1
⭐ Starred 717 / Rex::Box::Base
Security Advisories (1)
CVE-2026-94140 (2026-10-21)

Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no. Every remote branch of sync builds its ssh command with that option, for password authentication, for private-key authentication and for the fallback. The ssh options a caller sets through set_openssh_opt reach the OpenSSH transport but not this command, so there is no configuration that restores host key checking for the transfer. An attacker who can redirect the connection before the real host key is known presents their own and the transfer proceeds: under password authentication sync sends the connection password to that server, an upload writes the selected local files to it, and a download writes what it returns to the local destination.

NAME

Rex::Box::Base - Rex/Boxes Base Module

DESCRIPTION

This is a Rex/Boxes base module.

METHODS

These methods are shared across all other Rex::Box modules.

info

Returns a hashRef of vm information.

name($vmname)

Sets the name of the virtual machine.

setup(@tasks)

Sets the tasks that should be executed as soon as the VM is available through SSH.

storage('path/to/vm/disk')

Sets the disk path of the virtual machine. Works only on KVM

import_vm()

This method must be overwritten by the implementing class.

stop()

Stops the VM.

destroy()

Destroy the VM.

start()

Starts the VM.

ip()

Return the ip:port to which rex will connect to.

status()

Returns the status of a VM.

Valid return values are "running" and "stopped".

provision_vm([@tasks])

Executes the given tasks on the VM.

cpus($count)

Set the amount of CPUs for the VM.

memory($memory_size)

Sets the memory of a VM in megabyte.

network(%option)

Configure the network for a VM.

Currently it supports 2 modes: nat and bridged. Currently it supports only one network card.

$box->network(
  1 => {
    type => "nat",
  },
}

$box->network(
  1 => {
    type => "bridged",
    bridge => "eth0",
  },
);

forward_port(%option)

Set ports to be forwarded to the VM. This is not supported by all Box providers.

$box->forward_port(
  name => [$from_host_port, $to_vm_port],
  name2 => [$from_host_port_2, $to_vm_port_2],
  ...
);

list_boxes

List all available boxes.

url($url)

The URL where to download the Base VM Image. You can use self-made images or prebuild images from http://box.rexify.org/.

auth(%option)

Configure the authentication to the VM.

$box->auth(
  user => $user,
  password => $password,
  private_key => $private_key,
  public_key => $public_key,
);

options(%option)

Addition options for boxes

$box->options(
  opt1 => $val1,
  opt2 => $val2,
);