BTIBTI-2025-0025
CRITICALPUBLISHEDBTI-C09BTI-C09BTI-C10BTI-C12BTI-C13
9.5BTSS

TrenDemon

TrenDemon ABM Platform - eval() RCE, polyfill.io Supply Chain & Cross-Vendor Cookie Harvesting

Version
1
0
THE TAKE

TrenDemon is an ABM (Account-Based Marketing) content personalization platform. Critical findings include: (1) 6 eval() functions executing arbitrary JavaScript from CTA parameters enabling customer-level RCE, (2) polyfill.io supply chain vulnerability loading from COMPROMISED domain (June 2024), (3) 760-day cookie retention violating GDPR/ICO guidelines, (4) Cross-vendor Marketo cookie harvesting, (5) Base64 URL obfuscation to evade privacy tools.

This advisory exists to warn companies running TrenDemon on their sites. We do not notify vendors. We do not provide remediation windows. If you're using this vendor, this is your evidence.

0
//REVENUE_IMPACT

What It Costs You

CAC Subsidization

Visitor data captured on a site can flow into data broker networks and identity graphs, eventually surfacing in competitor prospecting tools. The original company paid to acquire the traffic; competitors pay pennies to intercept the lead.

Signal Corruption

Overlapping tracking mechanisms corrupt attribution data. Multiple sources claim credit for single conversions. Pipeline metrics diverge from reality. Marketing decisions get made on numbers that can’t be trusted.

Legal Tail Risk

Pre-consent data collection, undisclosed data sharing, and consent signal violations create regulatory exposure. Class actions and regulatory fines can exceed entire annual marketing budgets. Liability sits with the site owner, not the vendor.

GTM Attack Surface

Third-party scripts execute with full privileges on every page load. Dangerous code patterns, external dependencies, and data interception turn marketing infrastructure into attack vectors. One compromised dependency compromises the entire site.

//THE_MECHANISMS_OF_TAKING

BTI-C: Behavioral Codes

BTI-C09Consent BypassPRIMARY

“They take data before your users can say no.”

BTI-C09Consent Bypass

“They take data before your users can say no.”

BTI-C10Fingerprinting

“They take device signatures to track users who block cookies.”

BTI-C13Persistence

“They take permanent residence in your users' browsers.”

//BTSS_BREAKDOWN

BTSS Score Breakdown

Exploitability
3.5/ 4
Data Sensitivity
2.5/ 3
Prevalence
2/ 2
Detection Difficulty
1.5/ 1
//TECHNICAL_EVIDENCE

Technical Evidence

## eval() Arbitrary Code Execution The trends.min.js SDK contains a critical vulnerability in $Trd_Utils.sendGa4Tracking: ```javascript $Trd_Utils.sendGa4Tracking = function(ctaParams, event, page) { var trackingCodeToEval; switch(event) { case "load": trackingCodeToEval = ctaParams.CustomImpressionTrackingCode; break; case "click": trackingCodeToEval = ctaParams.CustomClickTrackingCode; break; } return (null == trackingCodeToEval ? void 0 : trackingCodeToEval.length) ? eval(trackingCodeToEval) // <-- ARBITRARY CODE EXECUTION : dataLayer.push(...) } ``` Any TrenDemon customer (or attacker compromising CTA configuration) can execute arbitrary JavaScript in visitor browsers. ## Marketo Cookie Harvesting TrenDemon reads Marketo _mkto_trk cookie, Base64-encodes it, stores as trd_ma_cookie, and transmits to trackingapi.trendemon.com/api/experience/personal. Evidence from HAR line 3206-3207: ```json { "name": "trd_ma_cookie", "value": "aWQ6OTU4LVRUTS03NDQmdG9rZW46X21jaC02c2Vuc2UuY29tLTMzZmUzNWQ0ZGY4ZDZlMzM0NDE5MjU0NTJhN2IwZTgw" } ``` Decoded: `id:958-TTM-744&token:_mch-6sense.com-33fe35d4df8d6e33441925452a7b0e80`

Code Evidence

javascripthttps://assets.trendemon.com/tag/trends.min.js

eval() arbitrary code execution in trends.min.js

$Trd_Utils.sendGa4Tracking = function(ctaParams, event, page) {
  var trackingCodeToEval;
  switch(event) {
    case "load": trackingCodeToEval = ctaParams.CustomImpressionTrackingCode;
    case "click": trackingCodeToEval = ctaParams.CustomClickTrackingCode;
  }
  return (trackingCodeToEval?.length) ? eval(trackingCodeToEval) : ...
}
httpHAR line 71875

Marketo cookie exfiltration

GET /api/experience/personal?
  AccountId=2705&
  ClientUrl=https://6sense.com/gartner-abm-magic-quadrant/&
  MarketingAutomationCookie=id:958-TTM-744&token:_mch-6sense.com-33fe35d4df8d6e33441925452a7b0e80&
  vid=2705:17648180428546372
Host: trackingapi.trendemon.com
javascripthttps://assets.trendemon.com/tag/trends.min.js

polyfill.io supply chain vulnerability (Line 13108-13145)

t.prototype.loadPollyills = function (t) {  // Note: MISSPELLED
  if (Array.prototype.findIndex) t();  // Modern browser - skip
  else {
    var e = document.createElement("script");
    e.src = "https://polyfill.io/v3/polyfill.min.js?features=...";
    // LOADS FROM COMPROMISED DOMAIN ON OLDER BROWSERS (IE11, Safari <9)
  }
};

Network Evidence

GEThttps://trackingapi.trendemon.com/api/settings/{accountId}

Configuration fetch

GEThttps://trackingapi.trendemon.com/api/events/pageview

Page view tracking with Base64-encoded URL

GEThttps://trackingapi.trendemon.com/api/events/pageread

Content read tracking

GEThttps://trackingapi.trendemon.com/api/experience/personal

Personalization + Marketo cookie exfiltration

GEThttps://trackingapi.trendemon.com/api/experience/ace-campaign

Campaign targeting

//LEGAL_TOUCHPOINTS

Legal Touchpoints

GDPR Art. 5(1)(e)European Union

Storage limitation - 760-day cookie retention

GDPR Art. 6European Union

No valid legal basis for cross-vendor cookie sharing

CCPA 1798.140California

Cross-vendor data sharing may constitute 'sale' of PI

ePrivacy Directive Art. 5(3)European Union

Cookie consent required before setting tracking cookies

//CITATION_TEMPLATES

Citation Templates

For Contracts / DPAs
“Vendor shall not engage in behaviors classified under BTI-2025-0025 (TrenDemon), including BTI-C09 (Consent Bypass).”
For Compliance Reports
“BTI Advisory BTI-2025-0025 documents TrenDemon engaging in Consent Bypass (BTSS 9.5, CRITICAL).”
For Email / Communication
“We have identified TrenDemon as exhibiting Consent Bypass behavior per BTI Advisory BTI-2025-0025. Full details: deployblackout.com/bti/BTI-2025-0025”
//RELATED_ADVISORIES
BTI-2025-0023Parent investigation (6sense surveillance stack)
//REFERENCES
vendorTrenDemon Website
scriptTrenDemon SDK
apiTrenDemon Settings API
Created: 2025-12-04Updated: 2025-12-04Version: 1
#eval-vulnerability#arbitrary-code-execution#cross-vendor-cookie-harvesting#extreme-cookie-lifetime#base64-obfuscation
Permanent URL: deployblackout.com/bti/BTI-2025-0025