While testing a company's systems security, I found out that they have allowed
WScript.Shell to run in all of their Internet Explorer for Intranet websites. It works if you open HTML files in your IE or if you access any of 500+ intranet site. Their intranet websites and intranet domains are huge, they have more than 500+ intranet web sites/applications.
As an example, I told them if an attacked knew about an internal XSS (which they have tons), someone from outside can craft a URL http://yourknownintranet/vuln.aspx?xss=Wscript.Shell(....) and send it to your employees with a good background story and most probably all of them will click.
They still consider it as low risk, they say it's Intranet only, you need another XSS for it, we need to have
WScript.Shell enabled, etc.
Anyone can help me here to convince them that it's not OK? Is there a way to impersonate Intranet etc? What other attack vectors might exist here?