Scan a folder of jars recursively for CVE-2021-44228 vulnerability

task.cfc

/**
* Scan all jars in folder recursivley for log4j vuln
*/
component {
	property name="progressableDownloader" 	inject="ProgressableDownloader";
	property name="progressBar" 			inject="ProgressBar";

	/**
	* @scanPath absolute or relative path to folder to look for jars
	*/
	function run( scanPath='' ) {

		var scannerJarPath = resolvePath( 'Log4JDetector-0.7.3-jar-with-dependencies.jar' );
		if( !fileExists( scannerJarPath ) ) {
			progressableDownloader.download(
				'https://github.com/CodeShield-Security/Log4JShell-Bytecode-Detector/releases/download/v0.7.3/Log4JDetector-0.7.3-jar-with-dependencies.jar',
				scannerJarPath,
				function( status ) {
					progressBar.update( argumentCollection = status );
				}
			);
		}		

		scanPath = resolvePath( scanPath );
		var jarList = directorylist( scanPath, true, 'array', '*.jar' );
		if( !jarList.len() ) {
			print.redLine( 'No jars found in [#scanPath#]' )
		}
		jarList.each( (j)=>{
			try { 
				var output = command( 'run' )
					.params( 'java -cp "#scannerJarPath#" de.codeshield.log4jshell.Log4JDetector "#j#"' )
					.run( returnOutput=true );
			} catch( any e ) {
				output = e.message;
			}

			print
				.line( output.replaceNoCase( scanPath, '' ), ( output contains 'not affected' ? 'green' : 'red' ) )
				.toConsole();
		} );

		print.greenLine( 'Done!' );
	}

}

An update to my previous comment- Log4j has now announced that adding the JVM arg is not sufficient to protect a vulnerable version of Log4j.
https://logging.apache.org/log4j/2.x/security.html
The only fix outside of updating the jar to 2.16 is to completely remove the JNDI class from the jar. You can do so with an archive program like Winzip or 7Zip. Adobe shows some methods to do this here:
https://helpx.adobe.com/coldfusion/kb/log4j-vulnerability-coldfusion.html