Scan a folder of jars recursively for CVE-2021-44228 vulnerability

task.cfc

/**
* Scan all jars in folder recursivley for log4j vuln
*/
component {
	property name="progressableDownloader" 	inject="ProgressableDownloader";
	property name="progressBar" 			inject="ProgressBar";

	/**
	* @scanPath absolute or relative path to folder to look for jars
	*/
	function run( scanPath='' ) {

		var scannerJarPath = resolvePath( 'Log4JDetector-0.7.3-jar-with-dependencies.jar' );
		if( !fileExists( scannerJarPath ) ) {
			progressableDownloader.download(
				'https://github.com/CodeShield-Security/Log4JShell-Bytecode-Detector/releases/download/v0.7.3/Log4JDetector-0.7.3-jar-with-dependencies.jar',
				scannerJarPath,
				function( status ) {
					progressBar.update( argumentCollection = status );
				}
			);
		}		

		scanPath = resolvePath( scanPath );
		var jarList = directorylist( scanPath, true, 'array', '*.jar' );
		if( !jarList.len() ) {
			print.redLine( 'No jars found in [#scanPath#]' )
		}
		jarList.each( (j)=>{
			try { 
				var output = command( 'run' )
					.params( 'java -cp "#scannerJarPath#" de.codeshield.log4jshell.Log4JDetector "#j#"' )
					.run( returnOutput=true );
			} catch( any e ) {
				output = e.message;
			}

			print
				.line( output.replaceNoCase( scanPath, '' ), ( output contains 'not affected' ? 'green' : 'red' ) )
				.toConsole();
		} );

		print.greenLine( 'Done!' );
	}

}

Please note, if you run your Adobe ColdFusion or Lucee servers via CommandBox you can apply the JVM arg to mitigate against this vuln globally like so

config set server.defaults.jvm.args='-Dlog4j2.formatMsgNoLookups=true'

And then restart any running servers.

An update to my previous comment- Log4j has now announced that adding the JVM arg is not sufficient to protect a vulnerable version of Log4j.
https://logging.apache.org/log4j/2.x/security.html
The only fix outside of updating the jar to 2.16 is to completely remove the JNDI class from the jar. You can do so with an archive program like Winzip or 7Zip. Adobe shows some methods to do this here:
https://helpx.adobe.com/coldfusion/kb/log4j-vulnerability-coldfusion.html