没有SQL，没有注射？检查NoSQL安全性
No SQL, No Injection? Examining NoSQL Security
摘要：
NoSQL数据存储系统由于其可扩展性和易用性而变得非常流行。本文探讨了NoSQL数据库安全措施的成熟度，解决了它们新的查询和访问机制。例如，新的查询格式的出现使得旧的SQL注入技术变得无关紧要，但是NoSQL数据库通常对注入免疫吗？在这里，我们提出了一些攻击NoSQL数据库的技术，如注入和CSRF。我们分析了这些漏洞的来源，并提出了减轻攻击的方法。我们发现，这个新的充满活力的技术领域缺乏安全措施和意识，多年来在传统的RDBMS SQL系统中开发。
英文摘要：
NoSQL data storage systems have become very popular due to their scalability and ease of use. This paper examines the maturity of security measures for NoSQL databases, addressing their new query and access mechanisms. For example the emergence of new query formats makes the old SQL injection techniques irrelevant, but are NoSQL databases immune to injection in general? The answer is NO. Here we present a few techniques for attacking NoSQL databases such as injections and CSRF. We analyze the source of these vulnerabilities and present methodologies to mitigate the attacks. We show that this new vibrant technological area lacks the security measures and awareness which have developed over the years in traditional RDBMS SQL systems.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
