"an attacker would have to send a specially crafted HTTP request to the affected system"

"Disable IIS kernel caching"

That's definitely not client-side at all. IIS is the thing that uses http.sys, and classic ASP.NET apps (not the new Core stuff) are usually deployed with IIS.