A security consultancy has identified a vulnerability that could allow an attacker to gain "user access level on integrated remote Citrix servers."

GnuCitizen, which identifies itself as a "cutting-edge think tank" and a "creative hacker organization," has posted a warning about a cross-site request forgery attack that can be made in conjunction with a malicious Web site to trick a Citrix user into opening a specially crafted Citrix independent computer architecture (ICA) file that would compromise his or her system.

If successful, the attacker could gain the ability to execute remote commands at the victim's access level.

"The success of the attack [relies] on the fact that the victim (the proxy) is part of a Citrix ring to which he/she can perform pass-through authentication," explains Petko D. Petkov, founder of GnuCitizen and its lead researcher, in a blog post. "Once a connection is instantiated, the victim will unwillingly and transparently login into Citrix and perform several commands specified by the attacker. The attacker can simply instruct the remote desktop to download files from a remote TFTP server and execute them locally. Once the attack is performed, the local connection is terminated and the Citrix session is cleared. No user interaction is required!"

In an e-mail, Petkov characterized the vulnerability as quite severe. "It is a remote command execution attack which cannot be easily fixed, mainly because it relies on features rather than bugs," he said. "If the attacker tricks a user from the targeted network into visiting a malicious Web site or opening a specially crafted ICA file, then they might be able to gain access to critical corporate assets. The attack is very simple and highly effective. Citrix is also a very popular platform. This makes this issue extremely problematic."

Petkov said that while he doubts the vulnerability is widely known, "anyone with the right methodology and mindset will be able to rediscover it."

Citrix said in an e-mailed statement that it "has become aware of recent blog postings relating to insecure deployment of Citrix products." The company said that while no specific vulnerability was identified, it recommends that its customers follow the security practices outlined on its Web site.