If I understood it correctly, there was one contract (EthCrossChainManager) which could call arbitrary methods on other contracts, the methods being identified

If I understood it correctly, there was one contract (EthCrossChainManager) which could call arbitrary methods on other contracts, the methods being identified by a 4-byte hash. There was another contract (EthCrossChainData) which had a method the attacker wanted to call, since it allowed to change relevant public keys, but which had a check on the identity of the caller. However, that check allowed the former contract to call the later. So the attacker only had to find a method name which led to the same 4-byte method identifier, and trick one contract into calling the other; the first one though it was calling an arbitrary function on an unrelated arbitrary contract, while the second one thought it was a legitimate internal call from the related first contract. As another comment mentioned, this is a classic "confused deputy" vulnerability.