Python's function urllib.parse.urljoin is used to construct an absolute URL by combining a base URL. It uses components from the base URL, such as the path, to provide missing components in the relative URL.

Example of vulnerable code:

An attacker can use the following attack technique to overwrite the original URL with a new specified URL. This behaviour opens up the possibility for open redirects (CWE-601) and Server-side Request Forgery (SSRF) (CWE-918) vulnerabilities to be exploited.

The attack workflow can be illustratied as shown below:

Now that you know how you can use this techniques to your advantage, you can test your practical skills in the official lab below.

Python Pitfalls - urljoin