Hello,
Replace your <rewrite> block in MRS/web.config with this to block the known vulnerable force-reset-password and upload endpoints. Please note that this will break uploading files + resetting passwords.
<rewrite>
<rules>
<rule name="Block upload endpoint" stopProcessing="true">
<match url="^api/upload$" ignoreCase="true" negate="false" />
<action type="CustomResponse" statusCode="403" statusReason="Forbidden" statusDescription="Blocked" />
</rule>
<rule name="Block force-reset-password endpoint" stopProcessing="true">
<match url="^api/v1/auth/force-reset-password$" ignoreCase="true" />
<action type="CustomResponse" statusCode="403" statusReason="Forbidden" statusDescription="Blocked" />
</rule>
<rule name="HttpReverseProxyInboundRule" stopProcessing="true">
<match url="(.*)" />
<conditions>
<add input="{HTTPS}" pattern="on" negate="true" />
<add input="{REQUEST_URI}" pattern="^/proxy-error-502\.3\.html" negate="true" />
<add input="{REQUEST_URI}" pattern="^/proxy-error-502\.4\.html" negate="true" />
</conditions>
<serverVariables>
<set name="HTTP_X_Forwarded_Host" value="{HTTP_HOST}" />
<set name="HTTP_X_Forwarded_Proto" value="http" />
</serverVariables>
</rule>
<rule name="HttpsReverseProxyInboundRule" stopProcessing="true">
<match url="(.*)" />
<conditions>
<add input="{HTTPS}" pattern="on" />
<add input="{REQUEST_URI}" pattern="^/proxy-error-502\.3\.html" negate="true" />
<add input="{REQUEST_URI}" pattern="^/proxy-error-502\.4\.html" negate="true" />
</conditions>
<serverVariables>
<set name="HTTP_X_Forwarded_Host" value="{HTTP_HOST}" />
<set name="HTTP_X_Forwarded_Proto" value="https" />
</serverVariables>
</rule>
</rules>
</rewrite>